Amazon has blocked Muse, Meta's personal AI agent, from making purchases on Amazon.com.
According to GeekWire, the block began appearing overnight from Sunday to Monday, when users received a message stating that access through an unauthorized AI agent violates Amazon's terms of use.
It sounds like a specific dispute between two technology giants.
In practice, it raises a much bigger question: what happens when an AI agent acts for a user inside a website that does not want agents operating there?
What Amazon blocked
Meta launched Muse in early September as a personal AI agent intended to perform tasks for users.
Later in the month, the company expanded Muse to Mac too.
After receiving user permissions, the system can work with files, messages, calendars, emails and additional tools.
One possible use is browsing and taking actions online.
Amazon decided to block the agent from making purchases on its website.
According to Amazon, Meta did not sufficiently disclose that Muse was accessing the website.
Amazon also claims the agent did not identify itself while browsing and appeared to collect and store users' login details.
Meta presents a different account.
The company says Muse cannot see passwords or payment details and that authentication details supplied by users are stored securely.
These are the two companies' claims, not an independent technical assessment by AI24.
Why this matters for the future of agents
AI agents are supposed to differ from an ordinary chatbot.
Instead of a user asking a question and getting an answer, an agent can open websites, click, enter information and take actions.
Once that happens, a new question arises:
Is permission from the user enough?
Amazon can argue that its website is a private service and that an automated agent must follow its rules.
Meta can argue that the agent simply represents a user who authorized it to act on their behalf.
This dispute is likely to recur across many websites and services.
Does the agent need to identify itself?
One of Amazon's central claims is that Muse did not identify itself as an agent while browsing.
This point may become more important as autonomous agents proliferate.
A website may treat a person, a simple bot, a web crawler and an AI agent acting for a real user differently.
If every agent must identify itself, websites will be able to choose which agents they permit and which they block.
On the other hand, this would give platforms significant power to decide which agents can operate within their services.
What about passwords?
The dispute becomes even more sensitive when an agent needs to log into an account.
Amazon raised concerns about how Muse handles authentication details.
Meta says the agent cannot see passwords or payment details themselves and that the information is kept in secure storage.
Meta also describes mechanisms such as Muse Secure VM (an isolated cloud computing environment) and another agent called Sentinel that checks actions before they are performed online.
Here too, these are Meta's descriptions, not an independent security assessment.
Availability in Israel
Muse launched in the United States at this stage.
According to the published information, the service is not officially available to users in Israel.
Meta did not announce a date for expansion to Israel as part of the launch.
What we can learn already
This story illustrates that an AI agent is more than an intelligent model.
To be truly useful, an agent also depends on:
- Permissions
- Website policies
- Identity management
- Password storage
- Consent from external services
- Legal and technical restrictions
The model may be excellent, but if the website it tries to connect to blocks it, the task stops.
What Amazon and Meta have not yet clarified
It is unclear whether Amazon's block is temporary or permanent.
It is unclear whether Meta will change Muse to identify itself explicitly to websites.
It is also unknown whether Amazon would permit access in the future under a commercial or technical agreement.
The current clash is probably not the last.
As AI agents begin performing more real-world tasks, the question "who gave the agent permission?" will become one of the field's central questions.