Amazon Can Afford to Block AI Agents. Your Brand Can't

What Amazon actually blocked

Meta launched Muse on 8 September. Within 10 days it topped the free charts on Apple's U.S. App Store, and it passed 5 million downloads in its first three weeks. Muse handles email, calendars, restaurant bookings, and shopping, and it asks the user to approve a purchase before it goes through.

Within two weeks, Amazon had blocked it on three grounds. Meta never told Amazon that Muse would shop there, the agent doesn't identify itself while browsing, and it appears to store customers' Amazon credentials. Meta replies that Muse "has no visibility into people's passwords or payment methods." Muse isn't the first. Amazon has moved against shopping agents from Google, OpenAI, and Perplexity.

Amazon's official line is that agents "should operate openly and respect service provider decisions about whether or not to participate." Forbes points to a second motive. Amazon earned around $68 billion from advertising in 2025, and an agent that goes straight to the product skips the sponsored listings.

Blocking is rational for a company that owns the marketplace, the ad inventory, and its own agent. Before you copy it, check whether you own all three.

Why most brands can't say no

Blocking works when customers have nowhere else to go. Most brands' customers do, and the week Amazon closed its door showed where they would go. Shopify partnered with Meta to let Muse buy from Shopify-powered stores through Shop Pay, and made Muse checkout on by default for eligible stores, which can turn it off in their admin. A week later, Shopify opened checkout to browser-based agents, which can complete purchases "with the buyer's authorization." PayPal brought Muse checkout to its own merchant network. At Meta's Connect conference on 23 September, Walmart, Best Buy, Gap, Sephora, and Wayfair signed on as Muse partners. For many merchants, the platform has already made the call.

The law is moving too, though not cleanly. Amazon sent Perplexity a cease-and-desist letter on 31 October 2025, sued days later, and won a preliminary injunction in March, alleging that Comet disguised itself as Chrome. On 4 August, the U.S. Court of Appeals for the Ninth Circuit vacated the injunction, ruling that "it was the user who 'accessed' Amazon's computers, with the help of Perplexity's AI agent." According to Cooley, the court expressly narrowed the holding to anti-hacking laws, and its reasoning rests on the agent's traffic being routed through the user's own computer. Cooley adds that other legal theories, such as breach of terms of service, may remain available. Amazon is already testing those limits. An amended complaint filed on 21 September alleges that Comet's iOS app copies users' session cookies to Perplexity's cloud servers, which then request pages from Amazon directly. Whatever the courts decide next, blocking through litigation is slow, expensive, and uncertain. Few brands have Amazon's legal budget.

Customers are moving faster than either. According to Adobe, AI-referred traffic to U.S. retail sites grew 138 percent year over year in May and converted 54 percent better than other traffic. Those are people clicking through from AI assistants, not agents buying on their own. But they show where discovery is heading, and that those visitors are worth more.

When an agent can't get through your door, it doesn't wait. It goes to the store whose door works. Amazon can absorb that loss because it's the default destination. A mid-size retailer, a regional bank, or a telco can't. That leaves the real decision: the terms on which agents get in.

Know which agentic commerce you're in

"Agentic commerce" covers at least four different things, and they are arriving at different speeds.

• 𐩒Step one is an assistant on your own site that finds the product and takes the customer to checkout. It's the smallest step, but it already solves search better than filters do.
• 𐩒Step two is a customer who researches in ChatGPT or Perplexity, then buys on your site. That is the traffic Adobe measured.
• 𐩒Step three is an outside agent that compares prices and options across stores.
• 𐩒Step four is an outside agent that completes the purchase itself, like Muse or Comet.

Amazon blocked step four, and step four is the least proven. When OpenAI put checkout inside ChatGPT, Walmart found that Instant Checkout converted three times worse than items that sent shoppers to its own site. People were happy to research in a chat. Far fewer were ready to buy there.

Whether a customer hands a purchase to an agent depends on the purchase. In my view, two questions decide it: does this matter to me, and do I want to spend time on it? Purchases people already know, or don't care about, will go through agents first. A request like "buy me a cool T-shirt" is a different job. The customer wants to browse, and an agent that skips the browsing skips the point.

So the first question for your business isn't whether to let agents in. It's which of your purchases customers will hand to an agent, and at which step. The answer sets how urgent the next three decisions are.

Identity: know your agent

Your checkout was built around one question: Is this a human? CAPTCHA, bot detection, and rate limits all exist to answer it. An agent acting for a real customer fails every one of those tests, even though it should pass. So agents learn to look human, which is exactly what Amazon alleged about Comet.

Even Amazon expects to let agents in eventually. On its October 2025 earnings call, Andy Jassy said Amazon is "having conversations with and expect over time to partner with third-party agents." He added: "I do think that we will find ways to partner." A partnership needs an agent that can say who it is.

The infrastructure for that is arriving. Cloudflare's signed agents programme lets an agent sign every request cryptographically through Web Bot Auth, so a website can verify the agent instead of guessing. On 9 September, Visa, Mastercard, and Ant International announced a Know Your Agent framework to connect their agent protocols. At the time of writing, the partners had published no technical specification or rollout date.

Protocols verify the agent. What your business does with a verified agent is a product decision. Does it get a different flow from a human? Does it see the same prices and promotions? When an unknown agent arrives, does it hit a wall, or a slower path with more checks? Right now most companies answer these questions by default, in a bot-detection configuration nobody on the leadership team has ever seen.

Permission: design the decision point

Underneath, the dispute between Amazon and Meta is about consent. Muse asks the user before it buys, but Amazon doesn't see that approval. From Amazon's side, a stranger logged in with the customer's password. From Meta's side, the customer authorised everything. Both are right, because the consent happened somewhere the merchant can't see.

A password is all-or-nothing. It can't say "buy printer ink under $40, from this store, this month." Agentic commerce needs permissions that can: limited by amount, category, merchant, and time, and visible to everyone in the transaction.

Banks are drawing the same line, with more nuance. Charles Schwab blocks outside agents, including Muse, from moving clients' money, and its CEO Rick Wurster says it stops them "tens and twenties" of times a week. But Schwab plans to let outside AI tools check balances and do research through controlled MCP servers. Schwab is writing terms rather than building a wall: reading is allowed, moving money is not.

Business buying is a natural testing ground, and it's where we tested this question hands-on. On an AI-native procurement platform we designed, we prototyped the flows with OpenAI's Agents SDK before drawing a single screen, to see whether agents could do the work at all. The answer shaped the design. Instead of one agent doing everything, we split the work into micro-agents and added capabilities case by case: search first, then everything else. Agents were good at the legwork: finding equivalent products, summarising vendor responses, and comparing options side by side. They were the wrong place for the commitment. So we designed AI as decision support. It prepares the decision, and the final purchase stays with a person.

The principle carries over to retail and banking. Automation earns trust when the moment of commitment is designed, visible, and owned by a person. We explored why agents break without that in Where AI Agents Fail and From UX to AX.

For your product, that means three calls: which actions an agent can complete alone, which need the customer's confirmation, and how that confirmation reaches you, not only the agent's platform.

Payment: keep the wallet, share the cart

Credentials are where the dispute is sharpest. If an outside agent holds the customer's password, the merchant loses control of fraud checks and the customer relationship in one move.

Shopify's developer documentation spells out one model. The agent builds the cart, then hands the buyer to the merchant's checkout, and "the merchant always remains the merchant of record." Anthropic's Commerce Agent Blueprint, an open-source reference for shopping agents released on 3 September, includes no payment protocol at all. And OpenAI scaled back Instant Checkout in ChatGPT in March 2026, moving purchases to retailers' own apps. The race to standardise agentic payments is still open, but the direction is clear: the agent helps the customer choose, and the merchant keeps the checkout.

The business logic follows. The brand keeps the transaction, the data, and the relationship. In the opposite model, an outside agent logs in as the customer and the brand becomes a fulfilment endpoint.

The decision in front of you

Amazon made its call and can live with the cost. Most brands will meet a quieter version of the same moment: a spike in strange traffic, a support ticket from a customer whose agent couldn't finish checkout, a platform that has already switched agent checkout on for you.

Each of those moments forces one of the three decisions above. Made deliberately, they become part of the product: a door agents can use, on terms you set. Left to defaults, someone else makes them for you: your bot-detection vendor, your platform, or the agent itself.

Amazon can afford to say no. Everyone else needs to design a yes they control.