Meta Called Muse Secure and Private. Amazon Just Banned It From Shopping.

Amazon started blocking Meta's Muse AI agent from making purchases on its site on September 21, 2026. That was less than a month after Meta introduced Muse as a secure, private personal AI agent. The product description and the ban do not agree with each other.

Anyone who tries to buy something on Amazon through Muse now gets a message instead of a checkout screen. It reads: continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed. Engadget reported the block and the wording September 21.

Why Amazon shut the door

Amazon says it asked Meta to voluntarily keep Muse off Amazon before it resorted to a block. Meta didn't. Amazon's objections are specific: Muse doesn't identify itself while browsing, and it can access customer information without the safeguards Amazon requires.

“We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.”

Amazon compared the arrangement to food delivery apps and the restaurants they order from. Or travel agencies and the airlines they book. In Amazon's framing, Muse skipped that step and helped itself.

What several days with the app actually showed

WIRED senior writer Reece Rogers, who previously covered streaming for Business Insider, spent several days testing Muse. He documented the results September 20. He asked it to order breakfast from Kahnfections, a bakery popular with tourists in San Francisco.

Muse found the shop's site and added a biscuit sandwich to the cart. It picked cheddar cheese, because the site only allowed one choice, and selected no tip on his behalf. Rogers didn't let the order go through. He walked to the bakery and bought something himself.

The browsing itself was fast and accurate, he wrote, a real improvement over agents he'd tested a year earlier. What bothered him wasn't the shopping. It was everything else Muse kept asking for.

The gap between secure and what it asks for

Muse's ideas tab suggested, unprompted, that Rogers let it scan his full email inbox. It offered to photograph his meals to estimate calories, and asked when his passport and driver's license expire.

Users are opted in by default to having their conversations used for training Meta's AI models. Opting out takes work. The toggle is labeled Help improve our AI models. It's buried inside the app's Data controls menu, not a setting most users go looking for.

“We think this is a good default. Every Muse user gets a better personal agent as we all collectively use the product and help the model understand the intricacies of human life.”

Meta's counter, and what's still unverified

Meta disputes that Muse is a security risk. Muse has no visibility into people's passwords or payment methods, the company said in its announcement. Credentials go into secure storage, and Muse never sees them.

Purchases route through a single-use virtual card from Link by Stripe, not a stored number. Two large companies are now making opposite factual claims about the same product. Neither has published data settling it.

Meta also told WIRED that training data is sanitized to strip identifying information before use, but the company did not explain how that process works. Call it unverified, not confirmed.

The pattern privacy researchers are pointing to

Rory Mir, director of open access at the Electronic Frontier Foundation, told WIRED that chat windows feel private. They aren't. He says they're really direct lines to Meta's servers. Calli Schroeder, senior counsel at the Electronic Privacy Information Center, drew a comparison to Meta's own recent history.

Earlier this year, Meta opted all adult Instagram users into an AI deepfake tool by default. It pulled the feature days later after backlash. She sees Muse's opt-out defaults as a repeat of the same pattern, not a one-off.

Neither researcher has audited Muse's code or its data flows firsthand. Their objections are about default settings and disclosure, not a confirmed breach, and Trestlewire found no evidence of one. Amazon's objection is narrower: an unidentified bot placing orders on a site it does not control.

Amazon has made its verdict on Muse a matter of site policy, not opinion. Whether Meta changes the app's defaults to get back in, or simply leaves Amazon off the list, is the next fact to watch for. It is not an assumption to make yet.