Shoppers who sent Meta's shopping agent Muse to amazon.com on the night of Sept. 20, 2026, received a page stating: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Todd Bishop reported the block for GeekWire that night, and Amazon confirmed it.

The notice reveals the narrow set of controls a website owner actually holds over automated visitors — and Amazon reached for the one that binds the logged-in shopper, not the agent's maker.

Robots.txt Had Nothing to Work With

The second control, robots.txt, could not help Amazon. A rule in that file names a user agent string — the label software sends when requesting a page — and states what that software may fetch. Meta's crawler documentation lists five agents, and Muse is not among them. Robots.txt also cannot enforce its rules; it only requests compliance.

Amazon's robots.txt, fetched from amazon.com/robots.txt on Sept. 22, 2026, declares 101 user agent blocks. One hundred carry Disallow: /, the line that refuses an agent the entire site. ClaudeBot is listed twice, so those hundred blocks name 99 distinct agents. GPTBot, CCBot, PerplexityBot, ClaudeBot, Google-Extended, GoogleAgent-Mariner and GoogleAgent-Shopping are all refused everything.

Meta appears three times in the file. The agents meta-externalagent, meta-externalfetcher and meta-webindexer all receive Disallow: /. Two of Meta's five documented crawlers — FacebookExternalHit, which powers link previews in Meta's apps, and Meta-ExternalAds, which supports Meta's ad business — fall under the general User-agent: * rules, which keep crawlers out of cart, sign-in and account paths while leaving product pages open.

Muse has no documented agent string, so Amazon had no name to put in a rule.

The CFAA Option Collapsed in August

The Computer Fraud and Abuse Act, the 1986 anti-hacking statute, weakened as a tool for Amazon on Aug. 4, 2026. That day the Ninth Circuit threw out a court order Amazon had won against Perplexity over Comet, a browser that logs into a shopper's Amazon account and buys on their behalf. The court ruled that the shopper, not the agent's vendor, is the one accessing the website, quoting a brief from the Electronic Frontier Foundation and four other groups: "Perplexity's servers never directly access Amazon's servers."

Amazon had won that order in March 2026, keeping Perplexity's agent out of the password-protected parts of the store while the case ran. The Ninth Circuit put it on hold, heard the appeal on June 11, and vacated it on Aug. 4. Amazon asked for a rehearing en banc — 11 judges in that circuit, the Chief Judge and 10 drawn by lot. On Sept. 10, the court refused. Not one judge asked for a vote.

The court left one question open, writing into the opinion: "We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers." That reservation covers the case where the software company, not the shopper, runs the agent — and Muse does not run on the shopper's machine.

What Amazon Actually Said

Amazon gave GeekWire three reasons for the block: Meta never told Amazon that Muse would access its store, the agent "doesn't identify itself when it browses," and it "appears to capture and store customer credentials," which Amazon says could create privacy and security risks. An Amazon spokesperson told GeekWire that third-party applications making purchases on a customer's behalf "should operate openly and respect service provider decisions about whether or not to participate." Amazon has separately asked Meta to remove Amazon from the Muse experience.

All three reasons are complaints about Meta. The document Amazon is enforcing, Conditions of Use, binds the shopper.

The credential claim drew scrutiny. Meta had published on launch day where Muse stores credentials: inside a background service called authd, within the virtual machine Meta gives each Muse user. Meta's wording: "stored in your VM, not in centralized Meta infrastructure." The agent works from surrogate tokens, and a component called Sentinel "will replace any surrogate tokens with the real credential, obtained from authd, at the network boundary." On Meta's description, the model never sees the credentials. No independent check of that had appeared in coverage of the block as of Sept. 22, and Amazon published no captured request, no named endpoint and no disclosure timeline for its "appears to" claim.

Amazon's Own Position

Amazon has a shopping agent of its own and an advertising business built on page views. Alexa for Shopping launched in May 2026, as GeekWire notes. Amazon made more than $68 billion in ad revenue in 2025, by GeekWire's figure, from a business that "depends on people browsing its pages and seeing sponsored products." GeekWire also records Amazon's point that its other agent, Buy for Me, identifies itself and lets brands opt out — the exact behavior Amazon is asking of Meta.

Muse launched on Sept. 8, 2026, and Meta's engineering post published that day says the agent drives "a real up-to-date Chromium based browser," so the website records an ordinary customer session, and that browsing "will appear as your activity." Muse is U.S.-only and free with paid tiers. Neither Meta's launch post nor GeekWire gives a user count. Amazon detected the Muse sessions anyway — twelve days after launch — and neither company has said how.

GeekWire also notes Meta signed a multibillion-dollar deal in April 2026 to run agentic AI workloads on Graviton, the server processors Amazon designs for its own cloud. Neither company has said whether Muse is among them. If it is, Amazon is blocking an agent that runs on hardware Amazon rents out.

Meta had not responded by the time GeekWire published, and no response had surfaced in coverage as of Sept. 22.

Why Conditions of Use Was the Only Card Left

Conditions of Use reached Muse because the shopper running it had already accepted those terms. Robots.txt had no name to block, and the Ninth Circuit had stripped the CFAA of force against agents a person sends. Enforcing terms of service means telling your own customer that the way they chose to shop is not allowed — the sentence on Amazon's block page.

Anyone can write that sentence into their own terms. What Amazon has not explained is how it detected Muse at all. Until it does, this remains something Amazon did rather than something any website can replicate — and two things would settle the credential dispute: Meta opening its VM to an independent audit, or Amazon producing whatever its "appears to" rests on.