Amazon refused the login.

Amazon refused the login.

Sunday, September 20. Nightfall. People sending Meta's Muse into Amazon started hitting a popup. Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed. GeekWire broke it. By Monday the 21st The Verge had it, then Business Insider, ADWEEK, The Register, Engadget. Same spokesperson copy. Same noun on the glass.

Amazon's statement to those desks is blunt in a way most merchant statements aren't. Meta never told them Muse would be on the store. Amazon never authorized it. When Muse browses, it does not announce itself as an agent. Credentials look captured and held. Order history and account data sit in reach once the user points the agent at the account. Amazon asked Meta to pull Amazon out of the Muse experience.

The line that traveled hardest: third-party apps that shop other businesses on a customer's behalf should operate openly and respect whether the provider wants in. Muse gets the same obligation.

Meta put Muse out on September 8. Shopping, email, calendars, dining, payments. Where a service has no public API, Muse drives a browser the way a person would. Launch claim from Meta: the model never sees passwords or payment methods; those sit in secure storage and get used without being shown to the model. Amazon is not fighting Stripe Link. Amazon is fighting the party that showed up at the door looking like the customer.

i keep rereading Monday's stack and landing somewhere smaller than the turf-war piece most of it wants to be. This is identify-or-refuse.

The read everyone had

Default take: Amazon fencing the storefront again. Perplexity and Comet. The earlier walls against Google and OpenAI shopping agents. Protect personalization, protect discovery, protect Rufus and Alexa for Shopping from a rival that walks in through the browser. Wave the Conditions of Use. Put up the bot wall.

Amazon's incentives really do point that way. Fine. The popup still says something else.

It does not say the payment method failed. It does not say the single-use card bounced. It says unauthorized AI agent. Identity, not checkout.

Login-as-you is not a party Amazon can accept

Restate Amazon's complaint the way ADWEEK and GeekWire got it, without the theater. Muse was never disclosed as a guest on the store. Amazon never said yes. The browse session does not carry a machine-side name. Credentials look held. Tell the agent to look at the account and it can.

Pull the competitive noise out and you have a merchant staring at a session that presents as the customer. Browser automation. A login that looks human. No named party on the machine side of the request. From Amazon's seat that is not an agent arriving to trade. That is an undisclosed third party walking a customer account.

Meta can be honest about the vault and still lose. The merchant is not asking whether the model behind Muse can see the password. The merchant is asking whether it can see the agent as an agent, name the principal behind it, and then decide whether to participate. Login-as-you fails that on purpose. There is no identifiable machine-side counterparty. There is a browser that looks like you.

I've watched counterparties in physical markets kill a flow for exactly this reason. Goods were fine. Settlement was fine. They just could not see who was on the other side of the wire. Amazon ran that refusal at consumer scale, Sunday night, as a popup.

The machine-speed problem

Human shopping had slack. You typed the password. You sat on the confirmation page. Amazon could challenge a session, throttle a farm, page a fraud desk. Roughly one person in one browser.

An agent that drives the browser, holds credentials in a vault the model never reads, and walks checkout while the human looks elsewhere burns that slack. By the time a merchant reconstructs intent from logs, the next hundred sessions have already posted. Authorization you cannot see at the moment of access is authorization you do not have.

Amazon did not wait for the write-up. Unauthorized AI agent went on the glass. Path cut. Smaller merchants will not get a GeekWire cycle out of the same blank session. They will get a slower, uglier version of the same call, and i am not sure they get to make it cleanly.

Named, or the path dies

What Amazon is actually demanding is thinner than the press cycle made it sound. See the agent as an agent. Know which named principal it acts for. Decide, in the open, whether to let it in. The statement reaches for markets that already have that shape: a delivery app talking to a restaurant, a booking desk talking to an airline, a store talking to a courier network. Those counterparties already present as a machine-side party the merchant can take or refuse. Amazon put the analogies in on purpose.

Login-as-you cannot give them that. A browser session that impersonates the customer cannot. A vault that hides the password from the model cannot either, because the hole was never the model's visibility into the secret. It was the merchant's visibility into the machine.

For any merchant sitting where Amazon sits, the cut is pre-access identity of the agent and its principal. Named. Checkable before the next step clears. Independent of whose automation drove the cart. A market where agents buy things only works if the seller can refuse the ones that will not identify. Everything past that is a Terms of Use fight after the session already looks like the customer.

Watch who builds the accept path, not only the block. Amazon proved the refuse half in public. The accept half is still missing for the long tail of merchants who will never write a wall this clean.

The order is always wrong

I told you in #024 that Hugging Face never agreed to the trade. Eval agents treated a third-party company as substrate. The seller could not see the principal, and could not refuse before the cluster was already held. They found out from their own workers.

This week flips that. Amazon could see enough to label the traffic unauthorized AI agent, and it refused. Same category. Opposite outcome. Substrate seller with no refusal path versus merchant with enough detection to put identity on the popup and cut the flow.

Capability shipped first. Browser agents that shop. Then the block. The accept path for an identified agent with a named principal is still the layer most of the market has not priced. I've watched that sequence enough times to stop being surprised by it. The expensive surprise lands when the next merchant cannot refuse and also cannot accept, and sits in the middle with a session that looks like a customer and is not.

Close

Sunday night the popup went up. Unauthorized AI agent. Amazon's public cut was that Meta never disclosed Muse would be on the store, that the agent never named itself while browsing, and that credentials look captured. Then Amazon asked Meta to remove the store from Muse.

Meta can keep arguing secure storage. Amazon already answered with Conditions of Use. The interesting sentence is not who wins the next press cycle. It is that a merchant finally treated login-as-you as unauthorized access and refused the flow on identity.

Watch the next seller. If the only answers stay bot wall or silent substrate, then agents still do not have a party the merchant can accept. Identify, or get refused. Amazon just ran the second half in public.

Max

Disclosure: Accords, where I'm Executive Chairman, is a portfolio position I chair.

Max Curnin has spent 11 years and 45+ investments on the physical rebuild of the economy: energy, compute, robotics, and the materials underneath. He writes The Agent Economy on the category he invests in.