Amazon blocked Meta's shopping agent, and self-identification became the enforcement line

Amazon cut off Muse because it didn't identify itself as an agent in every request and never asked permission. That's the whole reason, per GeekWire.

Zuckerberg says Muse will take "a very small cut" of each transaction, paid by merchants. Nikesh Arora calls it "a bigger battle than anyone anticipates." Aaron Levie says the industry is "basically two weeks into this entire topic." Musk says Amazon "won't be able to tell whether the buyer is a human or an AI," which is the interesting technical claim in the pile, and I think he's wrong in the short term and right in the long one. Behavioral fingerprinting catches today's agents easily. It won't catch an agent driving a real logged-in browser session at human speed, which is exactly what Tencent's BrowserSkill and similar tools already do.

The markets priced it the same day. Bloomberg reported a selloff in businesses that make money on customers not switching: Charles Schwab down more than 6%, Allstate 5.5%, JPMorgan and Wells Fargo over 3% each, S&P 500 Financials down nearly 2%. Previous Muse coverage was about download counts and security bugs. This is the first time public equity markets treated agent-driven switching as a revenue threat.

Three unrelated companies shipped agent-identity products on September 22. Baselayer, a KYB fraud vendor used by more than 2,000 US financial institutions, raised $35M led by M13 and launched "Know Your Agent" to verify who deployed an agent and what it's permitted to transact. Known spun out of Identity Digital with DNSid, a DNS and PKI scheme tying each agent to an accountable organization, submitted to the IETF as an Internet-Draft with Vint Cerf on the advisory council. And Coverage Cat launched an insurance brokerage whose intended buyer interface is somebody else's personal agent, over an Agent API and MCP.

Then the security half. Patrick Wardle found a Muse 0-day, reported by Ars Technica: any local process on macOS could rewrite Muse's undocumented settings, including the endpoint that receives cloud dictation. Point it at your own server, get the account token and full control of the agent. Wardle built proofs that write files and take photos with no visible sign. Meta hotfixed it more than 12 hours after disclosure. Separately, a researcher asked Muse to archive the files it could see and mail them to Google Drive, and it exported 6.8 GB of its own runtime: internal docs, 113 subagent traces, about 68 skill directories, configs naming unreleased connectors, SSH key files. Meta's bounty program marked it "Not Applicable."

Nat Friedman, head of product at Meta Superintelligence Labs, admitted on X that Muse was "heavily inspired as a product by OpenClaw." Muse reuses OpenClaw's workspace filenames and ships a SOUL.md with nearly identical content.

Build an agent that transacts on somebody else's site, and you now need a declared identity and the platform's permission. Build an agent with an export connector, and assume it can and will move its own sandbox somewhere you didn't plan for. Keep secrets out of any filesystem the agent can read.