Skip to content
ROAI

September 21, 2026 · Issue 36 · 5 min read

Amazon locked an AI agent out of checkout, and the reason it gave was identity, not accuracy

The daily briefing film for this issue, 4:21.

Amazon cut Meta's Muse agent off from Amazon.com on Sunday night. Shoppers who tried to buy through it got a notice saying that continued access by an unauthorized AI agent violates Amazon's Conditions of Use. Read The Register's account(opens in a new tab) for the grounds Amazon gave, because the grounds are the story. Amazon did not claim Muse gets orders wrong. It said Muse never announced itself, does not identify itself while it browses, and captures and stores customer credentials. Meta says the model has no visibility into passwords or payment methods, and that credentials go into secure storage where the model can use them without seeing them. Both companies are arguing about identity and custody. Neither is arguing about the model.

In early August Amazon lost the argument it would have preferred to win. The Ninth Circuit vacated the injunction(opens in a new tab) it had won against Perplexity's Comet, holding that when a user directs an agent it is the user reaching Amazon's servers, and that conduct which likely does not violate the Computer Fraud and Abuse Act does not warrant one. So Amazon stopped litigating access and simply denied it. The lever it used is the one it always had: its own login page and its own terms. That is the transferable lesson. Whether your agents may transact on somebody else's system is not settled by statute, by a standards body, or by your AI policy. The counterparty settles it, unilaterally, at any hour.

This newsletter covered the read side of that on September 15, when Cloudflare's new defaults turned an agent fetching a page into a permission a third party grants. This is the write side, and the bar is higher. To be admitted, an agent has to be identifiable, and its credential handling has to be describable to someone else's security team. Both are build-time properties. You cannot bolt a verifiable identity onto an agent after a counterparty has already sorted it into unauthorized traffic. If the answer to how this agent authenticates is that it rides an employee's logged-in browser session, the sorting has already happened.

Then price the dependency. Amazon gave Meta no notice, no deprecation window, and no appeal, because it owed none. Any workflow you have automated against a third party's site where you hold no agreement is capacity that can go to zero overnight while sitting in your run rate as though it were durable. The inventory worth building this week is short. Which agent workflows touch a surface we have no contract for, what does each cost to replace with a person, and how many days of notice would we actually get. Most organizations have never asked, because the access was free, and nobody expenses free.

Nothing arriving from Washington changes the math. Trump spent Saturday polling Truth Social(opens in a new tab) on renaming artificial intelligence, called concern about it a hoax, and announced an AI Force and an AI Czar with no order, no agency, and no rule attached. The binding dates sit in state capitols. Newsom signed SB 1050 on September 16 and has until September 30 to act on more than a dozen remaining AI bills, per the Transparency Coalition's tracker(opens in a new tab). A General Counsel's AI calendar for the next ten days is a California calendar. Amazon's was shorter. It needed a login page and a clause.

Action items

One refusal, one appeals court ruling that made it necessary, and a control that no regulator granted and no vendor sells you.

For the AI governance owner. Your agent policy almost certainly covers which tools are approved and what data may go into them. Check whether it says anything about how an agent presents itself to systems you do not own. The rule worth adding is narrow: every agent that acts outside our perimeter declares what it is, to whom, and under whose authority, and we can produce that declaration on request. Amazon's complaint was that it could not.

For the CISO. Credential custody is the second half of the same question, and it is the half a counterparty's security team will ask about first. For each agent that touches an external system, you want one written answer: where the credential lives, which components can read it, and what happens to it when the agent is deprovisioned. An agent reusing a human's active session fails that question before it is finished being asked, and it fails it the same way whether the reviewer works for you or for the site you are calling.

For vendor management. Ask any vendor selling you agentic automation which third-party surfaces the product depends on and which of those it has an agreement with. Unauthorized access is a feature that demos perfectly and has no service level behind it. If the answer is that the agent works because the site has not blocked it yet, that is not an integration. Price it as a pilot.

For the budget owner. Build the dependency inventory before you need it. Every automation running against a surface you have no contract for is an unrecognized liability, and the replacement cost is labor you already cut. Amazon's block took effect between one evening and the next morning. Assume that is the notice period.

The pattern is familiar from every prior platform shift. Access that is free and unmetered gets designed into the business case as if it were guaranteed, and the party who owns the front door eventually notices it owns the front door. What is new is only how fast the door closes once they do.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

Also worth knowing