By Elena Vasquez

Meta's Muse agent passed 2.5 million downloads in its first two weeks, according to Sensor Tower data reported by CBS News, and briefly overtook ChatGPT at the top of Apple's App Store. Consumer AI agents are no longer a future scenario. They are already mediating purchases, and they are changing who controls the customer relationship.

An agent can compare products, evaluate policies, and complete purchases without the customer ever visiting a brand's website. The result, as MarTech reports in its analysis of agentic commerce, is that brands lose visibility into customer preferences and purchasing decisions. Brands now face a choice: compete when consumer agents increasingly mediate the shopping experience, or risk losing customers to competitors that do.

What happened when the first agents arrived?

Retailer reactions split within days. On Sept. 20, 2026, Amazon began showing a pop-up to people using Muse to shop its store, warning that access by an "unauthorized AI agent" violates Amazon's Conditions of Use. Two days later, PayPal announced that customers could shop and check out through Muse at PayPal merchants worldwide. Shopify enabled Shop Pay checkout for Muse across all its stores the day before that.

Within days, three major players made two opposite decisions.

Muse also has competitors. OpenAI launched Dots in late September, an always-on assistant inside ChatGPT that runs background workflows across connected apps, requiring a paid ChatGPT Pro or Business Premium plan. Google has Gemini 4 Argon in limited preview through its Fairwind Program. Apple's agentic Siri works across on-device apps, and Anthropic offers desktop control through Claude's Cowork app on Pro and Max plans.

Meta and OpenAI run each user's agent in a dedicated cloud environment. Browsing, comparison, and checkout happen on infrastructure the brand never touches. Each company sets its own rules for how the agent identifies itself. A brand's access policy must account for all of them.

Why did Amazon block while others opened?

Amazon told GeekWire that Meta never notified it that Muse would access the store, that the agent does not identify itself while browsing, and that it appears to capture and store customer credentials. Amazon generated more than $68 billion in ad revenue last year from people browsing its pages and runs its own shopping agent, Buy for Me, which identifies itself and lets brands opt out.

Most brands have neither an ad business of that scale nor an agent of their own. The more common scenario looks like Target's: a CNN reporter testing Muse could browse Target's site but had to enter personal details by hand because the retailer blocked autonomous clicks at checkout. As MarTech notes, such decisions often start as bot-management rules set by security teams, with marketing learning about them only when conversion drops.

The legal ground also shifted. In August, the Ninth Circuit ruled in Amazon's case against Perplexity that the "user" is the one accessing the site under federal anti-hacking law, and the AI company acts on that user's behalf. The ruling limits retailers' ability to use federal anti-hacking law against agents acting for customers. Terms of service remain a viable restriction, as Amazon's warning demonstrates.

Is there a middle path?

Yes. Visa's Trusted Agent Protocol, developed with Cloudflare, lets merchants verify signed agents and separate them from malicious bots. Mastercard requires agents to register and be verified before transacting on its network, and every Mastercard issuer in Europe is now enabled for Agent Pay. A brand can admit verified agents at checkout while still blocking scrapers.

Amazon argued that third-party agents buying from other businesses "should operate openly." The card networks now give brands a way to enforce that standard without shutting the door. A full block keeps only the customers who give up and shop manually; the rest take their agent, and everything it knows about them, to a retailer that lets it in.

What happens to customer data?

The preference data brands spent a decade collecting through on-site behavior now accumulates in a private environment the brand cannot see. Meta designed Muse to remember details the person mentioned only once, keeps a full audit trail for the user, and says it does not share conversations or data from the user's secure VM with its ad systems.

The measurement impact comes first. According to The Keyword's reporting on Shopify's Meta channel terms, Google Analytics and custom pixels do not fire in Meta's direct checkout. Shopify passes only server-to-server events for checkout started and completed. The order is recorded as the merchant's, but the behavioral trail that led to it never reaches the merchant's analytics — a problem for teams that spent years building CDPs (customer data platforms) around browsing sessions.

The pressure is quantified. In Checkout.com's 2026 research, 72% of merchants in the U.K. and U.S. agreed that consumers will adopt agent-led shopping faster than most merchants are prepared to accommodate. Deloitte's survey of 13,500 European consumers found 31% are open to leaving the final purchase to AI and 47% are unwilling. Brands that treat today's reluctance as permanent will repeat the mobile cycle, when customers carried smartphones for years before most brands had a checkout that worked on one.

How do agents judge brand policies?

Muse checks out with Stripe's Link, and Meta says Muse is the first agent covered by Link's purchase protections, including damaged or lost items, price drops, and no-fee returns on eligible purchases. The consumer's wallet now sets a baseline the agent compares a brand's terms against on every purchase, invisibly.

MarTech calls this a "coherence at velocity" problem. An apparel brand offering 30-day returns on its website, 14 days in its app, and final sale on marketplaces will lose to a competitor with one consistent policy, because an agent needs specific, consistent, quantifiable information on every transaction. The brand never sees a bounce or an abandoned cart. The sale simply goes elsewhere.

Liability expectations add pressure. In a Riskified survey of U.S. and U.K. shoppers, 50.8% said the AI platform should be responsible for unauthorized purchases, 23.2% said the retailer or brand, and 18.7% said the consumer.

Can brands still win preference?

Yes, on verifiable terms. Accenture's "Talk to My AI Agent" research found that 56% of consumers would tell an agent which brands to consider, while 37% of behaviorally loyal consumers would accept an agent switching brands if the alternative better fit their needs. Preference holds when the agent can verify it against consistent terms, accurate inventory, and loyalty benefits that apply without a human logging in.

The entry cost has dropped. PayPal supports WebMCP, an emerging standard that lets merchants participate in agent commerce through existing storefronts. MarTech's recommended first steps:

• Audit defaults: Shopify shares merchant products with Meta via Shopify Catalog by default, and direct checkout is enabled by default for eligible stores.
• Set funnel boundaries: Decide separately what verified agents can do during browsing, cart creation, and checkout, using Trusted Agent Protocol or Agent Pay signals instead of blanket blocking.
• Publish machine-readable policies: Keep return, shipping, and warranty terms identical across every channel.
• Make loyalty portable: Let an agent pass a loyalty ID and have benefits apply at checkout.
• Rebuild measurement server-side: Set up agent-channel reporting before an unexpected Q4 gap forces the issue.

When customers shop through agents, brands whose information agents can verify and whose benefits machines can understand will win. Amazon can defend its relationships with a wall and its own agent; everyone else has to compete on what the agent can read and use.