Agent access is a contract permission, not a law

Whether an agent may reach a website is turning from a legal question into a contract question. On 20 September 2026 Amazon blocked Meta’s shopping agent Muse, and the popup users saw did not allege hacking. It cited Amazon’s Conditions of Use — precisely the path the Ninth Circuit left open three months earlier, in a footnote.

What happened: the stated reasons and the enforcement channel

Meta launched Muse on 8 September 2026: a US-only personal agent that connects to email, calendar, payments, dining and shopping, runs on a Meta-operated secure virtual machine with its own browser, is free with paid tiers, and ships on iOS, Android, muse.ai and WhatsApp. A week after launch it became the top free app in the US App Store, ahead of ChatGPT.

On the evening of 20 September, people using Muse to shop on Amazon saw the popup: “Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed.”

Amazon gave GeekWire three reasons — all Amazon’s own account, with Meta not responding before publication: it was not made aware in advance and did not authorise the access; Muse appears to capture and store customer credentials and scrape account data; and the agent does not identify itself when it browses. The spokesperson’s stated standard is that third-party applications purchasing on behalf of customers “should operate openly and respect service provider decisions about whether or not to participate”. Amazon said it has asked Meta to remove Amazon from the experience, that the two are in direct conversation, and declined to comment on litigation.

One comparison matters: Amazon’s own agentic shopping feature, Buy for Me, identifies itself and lets brands opt out. Identifiable identity plus a counterparty veto is not a standard imposed on Amazon from outside. It is the standard Amazon already applies to itself.

Why the legal route narrowed to contract

This path was not chosen suddenly. It was narrowed by the courts:

• March 2026: Amazon sued Perplexity and won a preliminary injunction;
• 4 August 2026: the Ninth Circuit (No. 26-1444) vacated it, holding that the user — not Perplexity — was the one accessing Amazon’s computers, leaving Amazon unlikely to succeed under the CFAA or California’s CDAFA;
• 10 September 2026: Amazon’s petition for rehearing was denied;
• The opinion’s footnote 5 left a route explicitly open: the outcome “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users”.

So the Muse popup alleges no hacking and cites Conditions of Use. That is the remaining path. The enforcer changed from a court to a platform’s contract team.

Our judgment: agent access is a contract permission, not a legal right

Three consequences, ordered by how directly they hit buyers:

1. The arbiter moved. For the past year, disputes over agent access swung between courts and regulators. With the CFAA route narrowed, the practical arbiter is now the counterparty’s terms of service. That is unilateral enforcement: no fact has to be proven in court, no regulatory process applies, and no judicial review is offered.
2. “We are entitled to access” and “the platform permits our agent to access” are two different things. The first is a contract between the user and the platform; the second is a permission between the agent provider and the platform. The Ninth Circuit confirmed the first for users and left the second with the platform.
3. A commercial partnership is not an exemption. Amazon and Meta are partners elsewhere: Amazon goods have been purchasable inside Facebook and Instagram since 2023, and in April 2026 Meta signed a multibillion-dollar deal to run agentic AI workloads on AWS Graviton chips. Amazon’s retail division still blocked a cloud customer’s agent. Permission does not travel across divisions or business lines.

Three acceptance items you can actually verify

Treat platform permission as its own acceptance dimension rather than a default pass. Three items are checkable:

1. Self-identification. The agent must be recognisable as an agent when it browses or calls, rather than posing as human traffic. Of Amazon’s three objections, this is the only one that requires no finding of fact — and the easiest to satisfy.
2. Credential custody. Do not store the counterparty’s account credentials; keep credentials on your own side. Amazon’s allegation against Muse was exactly that it captures and stores customer credentials and scrapes account data. Whether or not that is true, it is now the standard accusation template — making it architecturally impossible is cheaper than arguing about it later.
3. A counterparty exit. Give the service provider a way to decline participation. That is what Amazon’s own Buy for Me does, and it is the most negotiable position available: you are asking for recognisability and a veto, not unconditional passage.

One question for buyers

If a platform you depend on updates its terms tomorrow and writes “unauthorised AI agent access” in as a breach, how many agents on your inventory become non-compliant immediately? Do you have that inventory today?

References: GeekWire, 20 September 2026 (popup text, Amazon’s three stated reasons and spokesperson quotes, Amazon ad revenue above $68bn, Muse launch details and mechanism, the Buy for Me comparison, and the litigation timeline all come from this report; Amazon’s claims about Muse are its own account and Meta did not respond before publication), geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping (curl HTTP 200) | Ninth Circuit opinion, No. 26-1444, 4 August 2026 (Amazon.com Services, LLC v. Perplexity AI, Inc.; the access holding, the CFAA/CDAFA analysis and the text of footnote 5 are from the opinion itself), cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf (curl HTTP 200) | Meta, Introducing Muse (8 September 2026), about.fb.com/news/2026/09/introducing-muse-personal-ai-agent (curl HTTP 200) | Amazon v. Perplexity background, retaildive.com/news/amazon-sues-perplexity-ai-shopping-agents/804871 (curl HTTP 200) | Meta’s AWS Graviton deal, geekwire.com/2026/meta-signs-multibillion-dollar-deal-to-use-amazons-graviton-chips-for-agentic-ai (curl HTTP 200).