An AI assistant that can browse the web is only useful while the web agrees to cooperate. Amazon has made that limitation unusually visible by blocking Meta's Muse personal AI agent from shopping on Amazon.com. Users who tried to send Muse to Amazon began seeing a warning that access by an unauthorized AI agent violated Amazon's conditions of use. The block was reported on September 21, less than two weeks after Meta introduced Muse.
This is more interesting to me than another benchmark or model release because it exposes a problem that sits outside the model itself. Muse can apparently operate a browser, navigate sites and perform multi-step tasks. None of that guarantees that the service on the other side wants an automated agent there. We are moving from the question of whether an AI can perform an action to whether it is actually authorized to perform it. Those are very different engineering problems.
A browser is not an API contract
Meta introduced Muse on September 8 as a personal agent designed to work proactively on a user's goals. Meta says it runs inside a dedicated secure virtual machine and can use a browser to perform tasks such as researching products, filling forms and completing purchases. The design is deliberately broader than a normal chatbot. Instead of merely explaining what to buy, the agent is supposed to do some of the work.
Amazon's response demonstrates the weakness of treating ordinary websites as universal interfaces for agents. According to reporting from GeekWire, TechCrunch and Axios, Amazon said Meta had not arranged authorization for Muse to shop its store and that the agent did not identify itself while browsing. Amazon also raised concerns about customer credentials and data handling. Meta's own description says Muse cannot see passwords or payment details and that sensitive credentials are kept in secure storage. Those statements are not necessarily contradictory. A credential can be hidden from the model while still being used by the surrounding agent system.
For software engineers, the distinction matters. A human using a browser arrives with an established set of assumptions about identity, consent and interaction. An autonomous process that uses the same interface can operate at machine speed, preserve information between tasks and make decisions without the user watching every click. The HTML may be identical, but the security model is not.
Agents need identities of their own
The obvious technical answer is not to make agents better at pretending to be people. It is to give them an explicit identity. A service should be able to distinguish Leo using a browser from an agent acting for Leo, determine what that agent is allowed to do, and record what happened. That resembles service accounts, OAuth scopes and delegated authorization more than ordinary web automation.
A mature version of agentic commerce might therefore require a chain of authority. The user authorizes an assistant. The assistant identifies itself to a retailer. The retailer grants a defined set of capabilities, perhaps product search, cart modification and checkout up to a spending limit. Sensitive actions can require another confirmation. Each step can then be audited. This is much less magical than an AI freely navigating the internet, but it is also much closer to something I would trust around real accounts and money.
Without that layer, websites are forced to infer whether traffic represents a person, a scraper, a bot or an authorized personal agent. Agents are left depending on interfaces that can change or disappear at any moment. A sufficiently capable model cannot solve that governance problem by reasoning harder.
The platform has a vote too
There is also a commercial problem hiding inside the technical one. An assistant that shops for a person can potentially sit between the customer and the retailer. It might compare products differently, skip promotional pages, ignore recommendation systems and reduce the value of the retailer's own interface. Axios noted that the dispute reflects a broader fight over who controls the shopping relationship as agentic commerce develops.
That means agent interoperability will not be decided purely by open technical standards. Platforms have incentives, policies and their own assistants. Even if an agent can technically navigate a service, the service provider may decide that the interaction is unacceptable or only permit it through an approved integration. We have seen this pattern before with APIs, scraping and third-party clients. AI agents simply make the stakes larger because they can perform whole workflows rather than retrieve a page of data.
This is one reason I think the next phase of assistants will depend heavily on boring infrastructure. Authentication, delegated permissions, rate limits, audit logs, revocation and standardized tool interfaces are not impressive demo material. They are what turns a model with browser control into software that other systems can safely recognize.
Useful assistants need cooperation, not just intelligence
Muse getting blocked does not mean personal agents are a dead end. It shows what has to be built around them. Meta's launch demonstrated the direction clearly: an assistant with its own computing environment, persistent context and the ability to take actions. Amazon's block demonstrates the other half of that future. The external systems an assistant touches need mechanisms for deciding whether those actions are legitimate.
The web was designed primarily around people operating applications and applications calling documented APIs. Personal agents sit awkwardly between those models. They represent a person, but they are also software. Treating them entirely as either one creates problems. If they masquerade as ordinary users, services lose visibility and control. If every action requires a traditional bespoke API integration, the broad usefulness promised by general agents becomes much harder to achieve.
The interesting engineering work is therefore shifting outward from the model. Better reasoning will help an assistant decide what to do, but identity and permissions determine what it should be allowed to do. Amazon blocking Muse is a small incident in one shopping workflow. It is also a useful reminder that an assistant capable of clicking every button on the internet is not the same thing as an assistant that has permission to click them.