Amazon has blocked Meta’s Muse AI agent from shopping on its retail site after Meta declined a request to remove Amazon from the service, according to statements Amazon provided to news organizations. The dispute turns agent identification, customer-account access and merchant consent from design questions into immediate payment-control issues.
Amazon says Muse did not disclose itself while browsing and appeared to capture and store customer credentials, creating potential privacy and security risks. Meta’s launch documentation describes the architecture differently: credentials are kept in secure storage inside a dedicated cloud environment, while Muse itself has no visibility into passwords or payment methods.
No disclosed payment failure, confirmed credential exposure or customer loss has been established. The verified event is an access block amid conflicting company descriptions of how the agent handles credentials and permission.
Amazon says the agent lacked authorization
Muse users began seeing a message saying continued access by an unauthorized AI agent violated Amazon’s conditions of use. Amazon said it had asked Meta to stop the access voluntarily before imposing the block and argued that third-party applications buying from other businesses should identify themselves and respect a service provider’s decision on whether to participate.
The retailer’s objection is not simply that software helped a customer shop. Amazon’s reported position is that Meta did not notify it that Muse would access the store, the agent did not identify itself while browsing, and the system appeared to capture and store customer credentials. Amazon asked Meta to remove Amazon from the experience.
Those are Amazon’s claims, not findings by a regulator or court. Meta had not supplied a public response to the block in the reports reviewed for this article. Its September 8 launch announcement does, however, provide a first-party account of the controls it says are built into Muse.
Meta says credentials are stored but hidden from the agent
Meta says Muse runs in a dedicated virtual machine with its own browser. Data and credentials for connected services are stored in that environment, while a separate Sentinel agent reviews internet-bound actions and seeks permission when needed. According to Meta, Muse cannot see a user’s passwords or payment methods, checks with the user before sensitive actions such as a purchase and provides an audit trail of completed and planned activity.
That explanation does not make Amazon’s concern disappear. It clarifies that “capture and store” can describe a credential-vault function rather than the AI model reading a password. But it leaves a separate authorization question: whether a user’s permission allows an outside agent to access a merchant account when the merchant has not agreed to that form of access.
The distinction matters for risk teams. Protecting a secret from the model is one control. Establishing who is using the account, whether automated access is permitted and what the merchant can reliably detect is another.
The payment layer adds more parties to the chain
Meta says Muse can check out using Link by Stripe. Its announcement says Link’s agent wallet generates a one-time-use card so the underlying card details remain hidden and that Muse asks the user before making a purchase. Meta also announced future support for Shop Pay and 1Password.
Those controls address parts of credential exposure and user approval, but they do not settle every participant’s authority. A transaction can be backed by a valid one-time card and still raise questions about account access, bot disclosure, product selection, merchant terms and responsibility for a mistaken order.
For issuers, wallets, payment service providers and merchants, the relevant authorization record therefore needs more than a successful card credential. It should preserve what the user delegated, the product and price limits, the moment of confirmation, the identity of the agent and platform, and any substitutions or changes made before checkout.
Merchant consent is becoming a competitive control
Amazon’s position also exposes a conflict between open customer-directed automation and a platform’s right to control its storefront. An agent can compare products without responding to merchandising, advertising or recommendation systems in the same way a person does. That creates a commercial incentive to restrict outside agents alongside legitimate security and privacy concerns.
Amazon operates its own agentic shopping features. PaymentsJournal reports that its Buy for Me feature searches other companies’ sites, identifies itself and permits merchants to opt out. That does not resolve whether Amazon and Meta apply equivalent rules, but it shows why neutral technical standards for agent identity and merchant participation would be more durable than bilateral blocking.
What payment operators should require
The dispute gives payment and risk teams a practical control checklist. Agents should identify themselves to merchants; delegated authority should be narrow, time-bound and revocable; passwords and payment credentials should be isolated from the reasoning model; and every sensitive action should produce an auditable user-approval record. Merchants also need a machine-readable way to allow, limit or reject agent access without relying solely on behavior-based bot detection.
Dispute handling will be a critical test. Logs must distinguish a purchase the user approved from one the agent inferred, identify the responsible service at each step and remain available to merchants, issuers and consumers without exposing unnecessary personal data. Payment protection can allocate some financial loss, but it cannot substitute for clear authorization evidence.
Amazon’s block does not prove that Muse compromised an account, and Meta’s security design claims do not prove that merchants should accept the agent. It demonstrates that agentic checkout can be technically possible before the parties agree on who is authorized to enter the store, use the account and complete the payment.