Amazon blocked Meta's AI agent. It had a point.

Meta launched Muse on 8 September: a personal AI agent that sends your emails, books your travel and does your shopping. Two weeks later, anyone who tried to finish a purchase on Amazon through it got a popup instead: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed."

According to GeekWire, which first reported it, Amazon had asked Meta to keep its store out of Muse's reach and got nowhere. Its complaint has three parts: Meta never told Amazon that Muse would shop there, the agent does not identify itself when it browses, and it appears to capture and store customers' Amazon credentials. Meta's answer is that it "has no visibility into people's passwords or payment methods" — they go into secure storage, so Muse can use them without seeing them.

It is easy to read this as two giants fighting over who owns the checkout, and that is part of it. Amazon has agents of its own, and a store that controls how people buy has every commercial reason to control how machines buy too. But put the rivalry aside and the three complaints are good questions. Every site that sells anything will face them.

The web has always had rules for machines

Automated visitors are not new. Search crawlers have been reading the web for thirty years, and the arrangement has always been simple: say who you are, respect robots.txt, don't hammer the server. In return you get in. A crawler that pretends to be a person is treated as what it is — a scraper — and blocked.

An agent that shops for you is a new kind of visitor, but the same logic applies. It sits in a person's session, spends a person's money and sees a person's order history. The site on the other end is responsible for all of that: fraud checks, account security, what happens when something goes wrong. It cannot do that job for a visitor it cannot see.

Three things an agent should do

• Say what it is. An agent should identify itself in every request, the way crawlers do. Hiding behind a normal browser signature turns every fraud system into a guessing game and every analytics report into fiction. Amazon's own shopping agent, for what it is worth, identifies itself and lets brands opt out.
• Not hold the password. "We store it securely and never look" is a promise, and passwords are exactly the thing that should never depend on one. The web already has a better pattern for acting on someone's behalf: delegated, revocable permission — the "sign in with" flow you have used a hundred times — scoped to what the task needs.
• Ask the house. Using a site through its front door, automatically, at scale, is something the site gets a say in. The courts are still sorting out the law: in August a US appeals court overturned Amazon's injunction against Perplexity's shopping agent, holding that under the federal anti-hacking law it is the users who access the site, not the AI company, while leaving contract-based claims open. Whatever the legal answer, the practical one is that agents which ask get integrations, and agents which don't get popups.

What this means if you run a website

You don't need to be Amazon to have this problem. Agents are already reading and using small sites, and they will do more of it. A few decisions are worth making now, on purpose:

• Decide your stance and publish it. Which automated visitors are welcome, for what, and on what terms. On our own site, robots.txt applies the same rules to AI crawlers as to search engines, and says so.
• Give machines a proper door. Structured data, clean public pages, and an API or feed where a transaction makes sense. An agent that can read your prices and stock from a documented source has no reason to screen-scrape your checkout. We wrote a practical guide on making a site answerable by AI.
• Keep sensitive actions behind a human. Payment, account changes, anything that can't be undone: those should need the person, not their proxy.
• Watch your logs. A sudden rise in "normal browser" traffic that behaves like no human ever did is usually not a marketing success.

Agents are fine. Unannounced agents are the problem.

We are not against agents — we just think most businesses need fewer of them than they are being sold. An assistant that can compare prices and fill a basket is genuinely useful. But the web works because visitors are, broadly, who they say they are. An agent that borrows your identity, your password and your browser's fingerprint to walk into someone else's shop is not a new kind of customer. It is an old kind of problem with better manners.

Amazon's popup is self-interested. It is also right.