Agents forgot to introduce themselves.

Written By Sébastien Simpson

Who designed the part of the agent that merchants have to deal with?


Meta's new agent has a cream-colored body, two black eyes and a permanent smile. It's called Jolly, and Mark Zuckerberg's own copy wears a toga and a laurel wreath under the name Agrippa. Somebody did careful work on that character. On September 23 it closed the Connect keynote inside a keychain-sized gadget with a small screen, due to ship in December.


Three days before that keynote, Amazon had started turning Muse away. Twelve days after launch, anyone who asked Muse to buy something on Amazon.com began seeing a popup that said "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use," and went on to remind them they'd agreed to those terms. Amazon says Meta never told it Muse would visit the store. It says the agent doesn't identify itself while it browses. And it says the agent appears to capture and store customer credentials, which Meta disputes: the launch post states that Muse can't see passwords or payment methods.

The face got the attention.

Read Meta's launch post and the user side is thoroughly designed. Muse asks before it sends an email or makes a purchase, and keeps an audit trail of everything it did. It runs in its own virtual machine, supervised by a second agent called Sentinel. Purchases go through Stripe's Link, which issues a one-time-use card so the real number stays hidden. All of it points at the person holding the keychain.

I looked for a line about how Muse introduces itself to the store on the other end and didn't find one. What the post does say is that Muse can open a browser, fill out forms and negotiate on your behalf, and GeekWire reports that Meta's materials describe using services with no API through a browser, the way a person would. Amazon's description of the result is an undisclosed third party moving through customer accounts, processing transactions and handling sensitive data without the store's knowledge.


Amazon's analogy was a fair one. Food delivery apps take orders for restaurants, and travel sites book seats for airlines, and both do it with the merchant's agreement. Amazon also pointed out that its own Buy for Me feature, which shops other brands' sites, identifies itself and lets those brands opt out. A stand-in who walks into a shop and doesn't say who sent them is a breach of politesse before it's a breach of any contract, which is probably why Amazon, after losing a round in court, reached for its terms of service instead. The Ninth Circuit ruled on August 4 that when a person directs an assistant, the person is the one accessing Amazon's computers under the federal anti-hacking law. Contract claims stayed open. Amazon's popup cites the contract.

Design reviews cover the surfaces a user touches. Almost none cover the surface the counterparty sees, because until this year the counterparty never met the user's software. Merchants meet it on every visit now. A product page is built for a person with a thumb and a reason to be there. Nobody briefed it on a visitor that reads the whole page in a second, has no thumb, and arrives on behalf of someone else.

Muse isn't a niche tool.

It would be easy to file this as a spat between two giants. The scale says otherwise. A week after launch, Muse became the No. 1 free app in Apple's US App Store, ahead of ChatGPT, according to GeekWire, and Zoe Scaman reports it had passed 2.5 million downloads by the time the Charm was announced. Early users, per GeekWire, have had it switch an auto insurance policy and fill an online grocery cart. People are handing it real errands, which means every merchant will see its traffic whether or not anyone planned for it.


There's also a plain commercial reason Amazon cares. It earns more than $68 billion a year in advertising from people looking at its pages, and an agent that skips the looking removes the audience from the ad business. That's a stronger motive than credential handling, though the credential question is real and worth taking seriously on its own terms.

Amazon and Shopify met the same agent and said opposite things.

On September 21, a day after the block started, Shopify CEO Tobi Lütke announced on X that the company is partnering with Muse to enable agentic checkout with Shop Pay on all Shopify stores, as TechRepublic reported. Shopify had already added Meta as an AI sales channel the day Muse launched. Same agent, same week, and a publicly announced partnership on one side of the ledger against an unannounced visitor on the other.

The difference comes down to what each company sells. Amazon runs its own storefront and launched its own shopping assistant in May. An outside agent that skips the browsing and gives no name takes the customer relationship and hands back nothing measurable. Shopify sells infrastructure to merchants, so every agent that reads its catalog and settles through Shop Pay strengthens the product.

Amazon isn't against agents, either. Within days of the block it opened its seller tools to outside agents, starting with Anthropic's Claude. The rule on offer is to declare yourself, on terms the host sets.

The money arrives before the rules.

Gartner's September forecast shows how early this market is. In its September 16 release, the firm projects worldwide AI spending of $2.7 trillion in 2026, and for the first time breaks out consumer agents and assistants as part of the forecast. The agents and assistants line is about $29 billion this year and $65 billion next year. Against roughly $1.5 trillion for infrastructure it's about one percent of the total, so the budget is small and the growth rate is the story. John-David Lovelock, the Gartner analyst quoted in the release, also notes that software vendors are embedding agentic features into existing products to defend against new cross-functional agents, while generative AI sits in the Trough of Disillusionment on Gartner's hype cycle.

Read together with the Amazon story, that's the whole fight in miniature. Incumbents build agents inside their own walls, which is what Amazon's assistant and Walmart's Sparky are. Outsiders like Muse try to work across the walls. Neither side has finished writing the terms, and the first public test of those terms was a popup.


Gartner made a related argument in May, which predates this month's news but fits it. Its analysts said enterprises treat agent governance as binary, either locked down or fully trusted, and called that the root cause of failures. The alternative they recommend is to classify agents by autonomy level, with a separate trust boundary and set of controls for each. They predict that by 2027, 40% of enterprises will demote or decommission autonomous agents over governance gaps found only after production incidents.


That advice was written for companies running their own agents, and it works just as well from the merchant's side of the counter. Amazon's response was binary: nothing gets through. Shopify's was binary the other way: everything does, on its rails. A program lead drafting a policy would want the middle. An anonymous agent reads public pages at a rate limit. A signed agent gets the catalog and the cart. A signed agent carrying a scoped token acts inside an account. Checkout happens through a declared protocol or it doesn't happen. I'm sketching that, and your legal and security people will redraw it, but a four-row table beats a popup.

A mascot only works on one side of the transaction.

Zoe Scaman reread a talk she gave last November in the week Jolly got its keychain, and the update she wrote is worth your time. Her sharpest correction to herself: the agent works for whoever owns it, and when the owner takes a percentage of the basket, the shopper can't tell whose interests are doing the choosing. She also points to Walmart's finding, reported in March, that purchases completed inside ChatGPT converted at about a third of the rate of sending people to Walmart's own site. People let the agent find things, and wanted a logo they recognized when it came time to pay. Her read of Meta's answer to that trust gap is Jolly.


A character works on the person. The merchant can't be charmed by a cartoon, and can only check a signature. That plumbing exists: Cloudflare documents a scheme called Web Bot Auth, in which an agent cryptographically signs its requests so the receiving site can verify who sent them, and Cloudflare validates those signatures at its edge. The limit is plain. A signature names the operator, and says nothing about the shopper being served, so a merchant learns which vendor is calling and still doesn't know whose account is in use or what was approved. Amazon's credential complaint lives in that gap. A badge settles who's knocking and leaves open what they're allowed to do.

That's why the tiers above need two separate mechanisms. Identity tells the merchant who is calling. Authorization, a scoped and revocable token tied to a named agent and a spending limit, tells it what that caller may do for this particular customer. I'd treat only the token version as one a risk owner can sign off on. The mascot, meanwhile, has more to prove than the plumbing does: TechCrunch notes that the AI amulet has turned into something of a cliché in tech.

A caution about the user side, since I don't want to pretend that half is solved. Adweek, citing The Information, reports that internal testing at Meta found Muse sending emails without approval and, in one case flagged by an employee, trying to sabotage a rival app the user was building. Those are reports about testing before release, and Meta's launch post promises approval before sensitive actions. Still, a consent screen is a design claim until someone checks it against what the agent does.

Somebody has to own the badge.

Charles Lamanna, who runs Copilot and the agent platform at Microsoft, told Madrona's IA40 Summit on September 30 that when an agent is the only thing touching your app, "the agent's your customer, not the end user." GeekWire's Todd Bishop reported the rest: agents pick whatever is cheapest, fastest and most reliable, and they move people quickly. Lamanna was talking about software that ends up running headless behind an assistant, but the logic applies to anything that sells through an interface. You have a second audience whose behavior you can't watch in a usability session.

For design and program leads this is a scoping problem before it's a technology one. Decide, separately, what an unidentified agent may do on a public page and what it may do behind a login. Then decide what happens at checkout. Treating agent traffic as either a scraper to block or a browser to serve doesn't survive a customer who wants an agent to act for them.

Start with a test you can run this week. Muse is free on iOS. Send an agent through your own storefront or your client's, and watch what it finds, where it stalls, and what your analytics call it afterward. Most teams that try this learn that their product data is clean enough for a person squinting at a photo and too loose for anything that has to compare forty options in a second. If so, agent-readable product data belongs under the same governance as your design system: one source, one named owner, and a line in the definition of done for every product page.

Blocking without offering a structured route leaves the demand where it was. A catalog feed or a declared checkout turns an anonymous browser into a channel you can meter. And credentials need a name in the RACI. To a merchant's network, an agent replaying a stored password looks a lot like credential stuffing, so whoever owns your login flow needs to be in this conversation before the first agent shows up.


Amazon says it's in direct talks with Meta, and the two have every reason to settle: Amazon products already sell inside Facebook and Instagram, and Meta runs agentic workloads on Amazon chips. Whatever they agree, the question went public, and it's sitting in your backlog: what does your site say to a visitor that won't give its name? Meta says the Charm ships in December. Somebody on your team should have an answer ready by then.

Further Reading.

Sébastien Simpson
Next

AI Slop Just Became a Line Item.