Amazon Locks Out Meta’s Muse After an App Store Win

Meta’s Muse reached No. 1 on Apple’s U.S. free iPhone chart on September 18, then Amazon locked the shopping agent out of its store. The popup landed Sunday night, two days after that ranking, and it named the product an unauthorized AI agent.

Muse still books travel, fills forms, and checks out on stores that will have it. The biggest store will not. That is the product, not a side fight.

Muse Hit No. 1 by Doing the Work Chatbots Don’t

On September 8, 2026, Meta put a personal AI agent that takes action on iPhone, Android, muse.ai, and WhatsApp, with AI glasses promised later. People message it the way they message a person. It keeps going after they close the app, and it asks before it sends mail or spends money.

Alexandr Wang, Meta’s chief AI officer, told interviewers there is no advertising inside Muse, and that most people should stay on the free tier. Paid plans sit at $20 and $100 a month for heavier use. Shop Pay was listed as coming soon on day one. Link by Stripe already handles checkout, and Muse is the first agent covered by Link’s purchase protections for agents, with a one-time-use card that hides the real number.

Wang posted that Muse was No. 1 in the App Store a week after launch. A September 18 snapshot put ChatGPT at No. 2, Google Gemini at No. 8, and Anthropic’s Claude at No. 13. Charts measure new downloads, not how often people come back.

EARLY DOWNLOAD COUNTS

• First five days: Sensor Tower counted about 730,000 installs after the September 8 debut.
• U.S. free iPhone chart: Muse passed ChatGPT on September 18, ten days after launch.
• First twelve days: Apptopia estimated 2.8 million installs on iOS and Android combined.
• Same-window iOS comparison: Apptopia put U.S. and Canada iPhone downloads at 1.8 million for Muse and 1.3 million for ChatGPT’s first twelve days.

Meta delayed the ship from April to September 8, and Mark Zuckerberg later said the wait was for safety and security. The agent still needs logins, calendars, and payment rails to do the work in the ads. That is the bargain users are being asked to make.

Sunday Night’s Unauthorized Agent Message

Shoppers who told Muse to buy on Amazon started seeing a popup on the night of September 20. It said continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which customers have agreed. Those terms, last updated August 14, 2026, already bar robots and similar extraction tools and limit how account information can be used for a third party.

Amazon said Meta never asked to put Muse on the store, the agent does not identify itself while it browses, and it appears to capture and store customer credentials. The company said it had asked Meta to take Amazon out of the experience after Meta declined to do so on its own. Meta did not reply at once. Its launch post says Muse has no visibility into passwords or payment methods, and that credentials sit in secure storage the agent can use without seeing them.

We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.

Amazon spokesperson, statement on the Muse block

The same statement said agentic third-party apps such as Muse have the same obligations as food-delivery apps and online travel agencies that buy only with a merchant’s agreement. Amazon declined to say whether it would sue. It is already talking with Meta.

Amazon’s advertising services brought in $68.6 billion in 2025. That line lives on people opening the store, searching, and seeing sponsored products. An agent that compares a stroller, skips the ads, and drops a one-time card at checkout does not sit in that funnel. Amazon also runs its own helpers, including Buy for Me, which the company says identifies itself and lets brands opt out.

Why a Cloud Browser Is Easier to Ban

Muse does not live on the phone the way a normal browser does. It runs on Muse Secure VM, a dedicated virtual machine in Meta’s cloud with its own browser. A separate Sentinel process on that machine has to approve anything the agent sends to the internet. Meta says the box is contained so no one else’s agent can reach it, and that a later Muse Confidential VM will encrypt the whole machine with a key only the person holds.

That design is the privacy pitch. It is also why Amazon can treat Muse as a third party walking through customer accounts. The traffic comes from Meta’s cloud, not from the shopper’s home IP and cookies. Elon Musk put the other case in a reply on X: Amazon will not be able to tell a human from an AI acting on their behalf if access is via the user’s IP address and cookies.

Perplexity’s Comet assistant, the last agent Amazon took to court, runs locally on the user’s machine and takes screenshots of the page. Muse’s launch materials describe a different path. If a service has a public API, Muse connects with credentials the user provides. If it has no API, the agent uses the service through a browser the way a person would. Amazon is blocking that browser.

People already using Muse for grocery orders still want that path kept open. A cloud agent that shops as you is only as useful as the sites that accept the machine sitting in Menlo Park’s data center. Ban the machine, and the errand dies even if the person said yes.

Shopify Opened Checkout the Same Week Amazon Closed It

On September 21, Shopify chief executive Tobi Lütke posted that the company was partnering deeply with Muse to enable agentic checkout with Shop Pay on all Shopify stores. Wang followed, saying Meta wants Musers to reach a wide range of stores. The merchant stays the seller of record. Shop Pay is the rail.

We are excited to announce we are partnering deeply with Muse to enable agentic checkout with Shop Pay on all Shopify stores, offering people an easy and delightful way to shop and check out with Muse. pic.twitter.com/KmRlKjoLoq

— tobi lutke (@tobi) September 21, 2026

Nikesh Arora, chief executive at Palo Alto Networks, wrote that every services, marketplace, or commerce app will have to decide whether to open APIs for consumer agents, and that smaller players have no choice. Amazon can refuse. A Shopify merchant, on Lütke’s wording, is in the pool by default.

WHO LETS THE AGENT BUY

• Amazon: Blocked Muse on September 20 and asked Meta to remove the store from the product.
• Shopify: Opened Shop Pay checkout on all of its stores the next day.
• Stripe Link: Already covers Muse checkouts with a one-time card and purchase protections.
• Amazon’s own tools: Buy for Me and Alexa for Shopping stay inside Amazon’s rules, with brand opt-outs on Buy for Me.

The split is not a taste test. Shopify does not own the shopper’s attention, so it gains if an agent starts the trip. Amazon owns the shelf and the ad slot between intent and the cart. Platforms that live on browse and sponsored results will not let another company’s agent sit between the shopper and the shelf if they can stop it.

Hacking Law Failed, So Amazon Used the Contract

Amazon has spent a year trying to keep outside agents off the store. It sued Perplexity in November 2025 over Comet. It has also moved to block shopping agents from Google and OpenAI. Muse is the first of those fights to land on a No. 1 consumer app.

The hacking case did not give Amazon a lasting bar. A federal judge in San Francisco issued a preliminary injunction on March 9, 2026. On August 4, the U.S. Court of Appeals for the Ninth Circuit vacated the preliminary injunction in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444. Judge Milan D. Smith, Jr. wrote that it was the user who accessed Amazon’s computers, with the help of Perplexity’s AI agent, to carry out specific acts on Amazon.com. The court denied a rehearing on September 10. The lawsuit continues. Contract claims were left standing.

THE PERPLEXITY CALENDAR AMAZON IS NOW WORKING AROUND

1. November 2025: Amazon files suit, saying Comet reached password-protected account pages without permission.
2. March 9, 2026: The district court bars Perplexity’s agents from Amazon’s protected systems.
3. August 4, 2026: The Ninth Circuit vacates that order, holding the user, not Perplexity, did the accessing under the Computer Fraud and Abuse Act.
4. September 10, 2026: The full court declines to rehear the case.
5. September 20, 2026: Amazon blocks Muse with a Conditions of Use popup rather than a new hacking claim.

Comet and Muse are not the same machine. Comet runs on the user’s computer. Muse runs in Meta’s cloud. Amazon’s popup does not accuse anyone of hacking. It cites the contract shoppers already clicked. That is the door the appeals court left open.

What Users Hand Over for an Agent That Shops

Muse connects to email, calendars, payments, dining, shopping, music, and Meta’s own apps. It can turn a saved Instagram recipe into a grocery list and remember a friend’s dietary limits before it sends invites. People name the agent and pick an avatar. They also pick which apps it may touch, and they can tell it to forget.

Meta says Muse does not share conversations or VM data with its ad systems, and that people can opt out of training. The agent shows an audit trail of what it has done and what it plans to do. Later this year, Meta says, Confidential VM will put even Meta outside the key. Until then, the working copy of a person’s errands lives on a Meta machine.

WHAT EACH SIDE SAYS ABOUT THE LOGIN

Liat Ben-Zur, CEO of LBZ Advisory and a former Microsoft vice president of consumer services, said companies that control the rules of access will have enormous influence over whether those agents actually work for the consumer. Meta has been sued over smart-glasses footage sent to human reviewers; the company has disputed those claims. An agent that can switch an insurance policy or sell a car asks for a deeper grant than a feed ever did.

On Stage in Menlo Park, an Agent Amazon Will Not Serve

Zuckerberg is scheduled to open Meta’s annual event with a Connect keynote at 4 p.m. PT on September 23, with developer sessions on September 24. The agenda lists Muse Spark sessions and AI glasses programming. Muse’s own launch post said the agent is coming soon to those glasses. The hardware pitch and the agent pitch now share a stage, and they share a trust problem.

Amazon products already sell inside Facebook and Instagram, and the two companies work together on cloud chips. That did not keep Muse on amazon.com. Arora’s warning still sits over the next wave of copies from Apple, Google, and the model labs: smaller stores will open the API, and the large aggregators will charge a fare or shut the door.

Muse can still fill a cart on Shopify, pay with a one-time Link card, and keep a grocery list moving. It cannot finish the errand on the store that taught a generation to buy with one click. The agent that just took the top free slot on the iPhone is, on Amazon, a popup.