Amazon cut off Meta's Muse agent, and the reason list is a spec

Starting the night of September 20, Muse users who pointed the agent at Amazon.com got a popup instead of a product page: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed."

Twelve days after launch. Amazon holds something like 40% of US e-commerce, and this is the first hard block of a major consumer shopping agent by a retailer that size.

GeekWire got Amazon's three objections on record, and they read like a requirements document. One, Meta never disclosed that Muse would browse the store. Two, the agent doesn't identify itself. Three, it appears to capture and store customer login credentials. Amazon says it asked Meta to voluntarily exclude Amazon.com before pulling the trigger.

Meta's rebuttal is specific enough to be checkable: Muse "has no visibility into people's passwords or payment methods," and shared credentials "go into secure storage, so Muse can use them without seeing them." Both things can be true. An agent that never reads a password can still be the thing that holds the session, and from Amazon's side of the wire those look identical.

I've built enough browser automation to know how this argument goes. The retailer can't tell an agent from a scraper from a user on a weird browser unless the agent tells them. Meta chose not to tell them, presumably because identifying yourself is how you get rate-limited or blocked. That calculation just stopped paying.

What changes for anyone shipping a browsing agent: identification headers moved from optional courtesy to bid eligibility. Send a User-Agent that names your agent and links to a page describing what it does. Publish the IP ranges it operates from. And keep user credentials somewhere you can describe in one paragraph to a hostile counterparty, because you will eventually have to.

The credential point is the one I'd fix first. Meta's answer is the right shape, a broker that holds the secret and hands out authenticated sessions, but Amazon's objection is that "appears to capture and store" is what it looks like from outside. If your architecture can't be distinguished from credential theft by an observer at the other end of the connection, you've built something that will get blocked whether or not it's actually stealing anything.

Worth putting next to the drone story further down. The Pentagon's no-Chinese-parts rule for its 60,000-drone Gauntlet II order collapsed a $300M round a month earlier when most competitors couldn't meet it, and now it's an enforceable bid gate. Provenance requirements start as nice-to-haves and become the thing that decides whether you're allowed to transact at all. Agent identification is on the same track, and Amazon just fired the starting gun.