Computer-use agents vs API integration: Amazon's block on Meta's Muse is the contract you never signed

Meta launched Muse on 8 September 2026. Twelve days later, on Sunday night, Muse users trying to shop on Amazon.com got a pop-up instead of a checkout page: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.” Most coverage treats the block as a turf war between two giants, and it is one. But the argument over computer-use agents vs API integration was never really about which model is smarter. An agent driving somebody else’s screen is an integration the other side never signed, and the other side can end it whenever it likes.

TL;DR: Amazon cut off Meta’s Muse agent on 20 September 2026, saying Meta never told it Muse would shop there, that the agent doesn’t identify itself, and that it appears to capture customer credentials (Meta says it can’t see them). Amazon’s Conditions of Use already set out what an agent must do: put “Agent/[agent name]” in every request’s user agent string, not mimic human keystroke timing, and stop when asked. That’s a published integration contract, and Muse wasn’t a party to it. Every company running browser bots or RPA on carrier, payer and supplier portals has the same exposure. Computer-use agents work until the counterparty decides otherwise. Where it matters, use an API or get written permission.

What actually happened, and what each side says

The facts are narrow. Take them from the parties, not the headlines.

Amazon’s account, given to GeekWire, The Register and Gizmodo on 20–21 September: it asked Meta to exclude Amazon from Muse, Meta didn’t, so Amazon blocked it. Meta hadn’t said Muse would access the store. The agent “doesn’t identify itself when it browses.” It “appears to capture and store customer credentials.” If a customer asks, it can reach account pages and order history. Amazon’s statement: “third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.” It compared agents to food-delivery apps and restaurants, and to online travel agencies and airlines, which work with the merchant’s agreement.

Meta’s account comes from its 8 September launch post. Muse runs on a dedicated cloud VM with its own browser. A separate Sentinel agent has to approve anything Muse sends to the internet. Muse checks with the person before a purchase, and it “has no visibility into people’s passwords or payment methods” because credentials sit in secure storage it can use without seeing them. According to GeekWire’s reading of Meta’s launch materials, Muse connects through a public API when a service has one and uses a browser when it doesn’t.

That last detail is what the whole dispute turns on. On Amazon, Muse shopped through the fallback: the screen.

Two more facts matter. Amazon generated more than $68 billion in ad revenue last year, and that business depends on people browsing its pages, so the block isn’t purely about safety. And Amazon runs its own agent, Buy for Me, which buys from other brands’ sites. Amazon points out that it identifies itself and lets brands opt out. Set Amazon’s motives aside and the sentence still holds as a spec. The agent identifies itself, and the other party can say no.

The contract was already published

Most people haven’t read this part. Amazon’s Conditions of Use, in the version last updated 14 August 2026, contain a section called Agent Terms. It defines an agent as “any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity.” Then it gets specific. In all HTTP/HTTPS requests, an agent must identify itself by putting “Agent/[agent name]” in the user agent string. It must not hide that it’s an agent by “mimicking the speed or pattern of human keystrokes, page navigation, or other interactions,” or by completing or getting around CAPTCHAs. It must answer truthfully if asked whether it’s a human. It must stop if Amazon asks it to.

Read that as an engineer rather than as a lawyer. It’s an interface specification: an identification header, behavioural constraints, a revocation clause. The only thing missing is the API. For an agent that doesn’t send the header, the whole relationship comes down to whatever the other side decides next.

The Register ran the obvious test. Asked to find an office chair and go to checkout, Muse replied that it had hit an anti-bot wall, that the browser “couldn’t even get to the search page,” and that it hadn’t pushed past it because the notice said continuing would breach Amazon’s terms. So the agent did the right thing. The workflow still failed, and nothing in the agent’s design could have saved it, because the dependency sat on Amazon’s side.

Why the court case doesn’t rescue the approach

It’s tempting to read the legal fight as the real question. Amazon sued Perplexity in 2025 over its Comet browser shopping on Amazon. A federal judge gave Amazon a preliminary injunction in March 2026. On 4 August the Ninth Circuit vacated it, finding that under federal anti-hacking law the user, not the AI company, was the one accessing Amazon’s computers. On 10 September it denied Amazon’s petition for rehearing.

Win that argument and you’ve settled whether you’re a hacker. You haven’t settled whether the checkout page loads tomorrow. GeekWire noted that the ruling left claims built on contracts and terms of service open, and Amazon’s pop-up cites its Conditions of Use, not hacking law. An operator doesn’t need to predict how that litigation ends. The counterparty has a technical off switch and a written policy that says it may use it “at our sole discretion.” Nothing that runs payroll, claims or freight should depend on a switch someone else holds.

The same integration, running quietly in your back office

Swap Muse for an RPA bot and Amazon for a carrier portal, and this is an ordinary Tuesday in operations.

Somewhere in most mid-sized companies, a bot logs into a carrier’s tracking portal with a dispatcher’s password and scrapes status into the TMS. Another pulls remittance files from a bank portal. Another checks prior-authorization status on a payer site. Another downloads supplier acknowledgements. Nobody at the carrier, the bank, the payer or the supplier agreed to any of it. Often nobody inside the company wrote it down either. The bot shares a human’s credential, so it looks like that human, which is exactly the “doesn’t identify itself” complaint Amazon made.

It usually doesn’t end with a lawsuit. It ends quietly. The portal gets a redesign and a field moves. A new MFA prompt appears. A CAPTCHA shows up on the login page. Session length drops from eight hours to one. The bot retries, the retries fail silently, and the TMS keeps showing the last good status for three days until a customer calls. I’ve written about what that looks like on the carrier side and on payer portals. The root cause is the same every time. Two systems exchange data with no agreement about fields, identity or change notice, and the whole integration rests on one side not touching its UI.

AI makes this worse, not better. A computer-use agent is far more capable than a 2019 RPA script. It reads a redesigned page and carries on instead of crashing. That sounds like resilience. In practice it means the agent keeps working against an interface that nobody promised would mean the same thing tomorrow, and when a field gets relabelled, it can quietly enter data in the wrong place rather than fail loudly. Human-speed browsing makes the risk worse. Amazon’s terms ban exactly that disguise, because it defeats the only way the counterparty can tell who’s there.

What each path gives you

	Computer-use agent on someone else’s screen	API or file feed the counterparty agreed to
Identity	Borrowed human session; looks like the user	Its own credential, scoped and revocable
Permission	Assumed until blocked (Amazon: “unauthorized AI agent”)	Granted and written down
Change notice	None; the UI changes when the other side ships	Versioned; deprecations announced
Field meaning	Inferred from a label on a page	Documented in the schema
Failure mode	Silent: wrong field, stale data, retry loop	Loud: error code, rejected payload
Who can end it	The counterparty, at any time, with a pop-up	Both parties, under the contract’s terms
Right use	No API exists, the work is low-stakes and reversible, and a person is watching	Anything that moves money, inventory, patient or legal status

Sources: Amazon Conditions of Use, Agent Terms (version last updated 14 August 2026); Amazon statements to GeekWire, The Register and Gizmodo, 20–21 September 2026; Meta, “Introducing Muse,” 8 September 2026.

What the working version looks like

The fix isn’t “never use computer-use agents.” Sometimes the screen is the only door, and a small agent checking a county permit site once a day beats a person doing it. The fix is to treat every screen-driven flow as a temporary integration with a contract still to be written, and to run it that way.

Start with an inventory. List every bot and agent that logs into a system you don’t own, whose credential it uses, what it reads, what it writes and which downstream process trusts its output. This is the same inventory gap that shows up with shadow AI, pointed outward.

Then rank by blast radius. A bot that reads a tracking status sits at the bottom. A bot that submits a claim, books freight or pays an invoice sits at the top. The top of the list goes to the counterparty first, with a request for an API, an EDI or SFTP feed, or written permission. Sometimes one already exists and nobody asked. Of the flows that stay on a screen, each should identify itself as automation, use its own credential rather than a dispatcher’s, and page a named person on the first failure, not the fifth retry. And the output should never be the system of record. It’s an input a person or a check confirms.

When I built the Salesforce–ServiceTitan–NetSuite integration at an energy contractor, the work that mattered wasn’t calling the APIs. It was settling which system owned which field and what happened when one of them changed. That’s the throughline in every integration I’ve done, and a screen-scraping agent skips it by design. It gets to the data without anyone having agreed what the data means. Writing that agreement down is most of the integration work, and it’s what makes the automation built on top of it last.

Amazon didn’t break Muse’s browser. It enforced a contract Muse never signed.