The most important sentence in agentic commerce this month wasn’t written by a regulator. It was a popup.
On Sunday, September 20, shoppers who asked Meta’s brand-new Muse agent to buy something on Amazon got a message instead of a delivery date. Amazon began denying Muse access, telling users that continued activity by an unauthorized agent violated the conditions attached to their accounts.
Muse was twelve days old.
If you run security, fraud, or digital at a bank, this looks like a retail turf war. It isn’t. It’s the first public test of a question your institution will face within a year, and Amazon’s answer — block it and cite the customer agreement — is an option you almost certainly don’t have.
What Amazon actually objected to
Three things, and every one of them should sound familiar to anyone who has ever run a bot program.
Amazon said Meta never disclosed that Muse would shop the store. It said the agent doesn’t identify itself when it browses. And it alleged that Muse captures and stores customer logins. Amazon says it asked Meta to stay out before it acted. Meta’s position is that Muse never sees passwords or payment methods — credentials go into secure storage the agent can use without viewing them.
Strip the brand names and you have the three questions every application owner is about to be asked in a board meeting: Do I know this agent is here? Do I know who operates it? And where, exactly, are my customer’s credentials sitting tonight?
The legal part is the part banks should read twice
Amazon didn’t reach for a popup because it likes popups. It reached for one because the courtroom route stopped working.
Amazon sued Perplexity last November over Comet, a browser whose built-in agent shops Amazon on a user’s behalf. In March a federal judge sided with Amazon and barred the agent from the password-protected parts of the site. On August 4, a federal appeals court threw that order out — reasoning that when an agent follows a shopper’s instruction, the shopper is the one using Amazon, and the software is merely doing what it was told.
Read that reasoning again with a bank’s hat on.
If the agent is legally just an extension of the customer’s own hands, then the session it opens in your app isn’t unauthorized access. It’s your customer, logging in. Which means your cleanest defensive framing — this is a bot, bots aren’t allowed, we block bots — has a real chance of collapsing the moment someone tests it.
Amazon’s response was to stop arguing that the agent broke in, and start pointing at the rules the customer accepted when they opened the account. That’s a clever pivot. It’s also a warning, because banks have built an entire consumer-protection edifice on top of exactly those terms — and it cuts in a direction Amazon doesn’t have to worry about.
The trap in your own terms of service
Nearly every bank’s account agreement says some version of: don’t share your credentials with anyone.
Your customer just did. Enthusiastically. To an assistant they text like a person.
So what happens the first time an agent-mediated session ends in a loss? You have two options and both are bad. Deny the claim on the grounds that the customer breached the terms — and explain that to a regulator, a journalist, and 100,000 other customers who did the same thing. Or pay the claim, and quietly accept that you now own the fraud risk of every third-party agent your customers choose, none of which you’ve assessed, contracted with, or can even identify.
This isn’t theoretical. It’s the screen-scraping fight, back with teeth. Consumer-banking agreements typically protect customers against unauthorized transactions only if they’ve kept their credentials private — so once those credentials go to a third-party app, that protection may not apply, and banks have argued exactly that when a scraping app gets breached. The industry has been trying to end this practice for years: Wells Fargo and PNC told aggregator Trustly to stop scraping their customers’ data last November, with Wells Fargo sending two cease-and-desist letters and both banks pointing Trustly toward APIs via Akoya.
Here’s what’s different now, and it’s not a small difference.
Scrapers read. Agents write. A data aggregator pulled your balance. A personal agent moves your money, disputes your charge, changes your address, opens the account, cancels the card. And if that agent has access to the customer’s email or texts — which Instinct, Muse and their peers routinely request — it can complete the MFA challenge itself, logging in indistinguishably from a human, potentially thousands of times a month.
Your step-up authentication is being answered by the thing you were trying to step up against.
Why “just block it” isn’t your strategy
Amazon can afford to block. It has somewhere else to send the shopper: its own Alexa for Shopping, which Andy Jassy said was used by more than 350 million shoppers over twelve months, with US customers spending 40% more per order when they use it. Amazon isn’t opposed to agentic shopping. It’s opposed to someone else’s agent standing between it and the customer.
A bank does not have that move. You are not going to ship the personal assistant your customer already chose, already trusts, and already texts. In the agent era your app is a supplier to somebody else’s interface, and the customer will not forgive you for being the one service their assistant can’t handle. Blocking a legitimate, customer-initiated bill payment because it arrived through Muse is not a security control. It’s a complaint waiting to be filed.
Meanwhile, the ground is moving fast:
- On September 10, Visa, Mastercard and Ant International said they’re building common rules for shopping agents — so networks, merchants and marketplaces can recognize an agent, see who operates it, and check whether it’s permitted to spend. That’s Amazon’s three complaints, turned into infrastructure.
- NIST’s NCCoE published a February 2026 concept paper on software and AI agent identity and authorization, covering agent identification, access delegation and logging.
- FDX launched an initiative in April 2026 specifically on safe, interoperable agentic AI in financial data sharing.
- HM Treasury’s July 2026 consultation asks outright whether rules on authentication, consent and liability for unauthorized transactions need to change when an agent can analyze, initiate, approve and execute payments.
Translation: within about eighteen months, “we didn’t know agents were in our channel” stops being an oversight and becomes a finding.
What control and intelligence actually look like
Amazon’s popup is the crudest possible expression of the right instinct. The instinct — know who is at the door before you let them in — is correct. The implementation is what you use when you have nothing better.
Something better has two halves.
Intelligence: see the agent. Not “bot or human” — that binary is now worse than useless, because the agent is a bot and it’s your legitimate customer. You need to know an agent is present, which one it is, who operates it, whether it’s driving a browser or calling an API, whether it holds a stored credential or a delegated token, and whether tonight’s behavior matches what that agent normally does. You cannot govern, price, or write a policy for traffic you can’t name. Today almost no institution can tell you what share of last month’s logins were agent-initiated — not because it’s unmeasurable, but because nobody instrumented for it.
Control: give the agent a front door. The moment you can identify an agent, you can do something far better than blocking it: understand what it tries to do (log in, transact, reset credentials etc), get the customer’s explicitly approval when needed, restrict it from using specific features, and audit each step in the journey.
The one thing to take from Sunday
Amazon blocked Muse because it could see it and didn’t trust it. Most banks today could do neither — they can’t see it, so the trust question never even gets asked.
That’s the actual scandal in this story. Not that Amazon shut the door. That the rest of us don’t yet know when someone’s walked through ours.
