Meta launched the AI agent Muse on September 8, 2026, and just a month later, analysts from Jefferies reported that approximately one-third of major American websites block it, another third impose checks or restrictions, and only the remaining third allow it without issues. Amazon blocked Muse's access on the night of September 21, complaints about denials have come from users of eBay, Yelp, Zillow, and airlines, and the service Fingerprint announced on October 6 that it has learned to recognize Muse traffic with high confidence. Let's analyze why Meta's agent is losing to anti-bots and what conclusions should be drawn by everyone automating work in the browser.
What is Muse and how does it navigate websites
Muse is a personal agent for long tasks, rather than a chat bot with one-message responses. The user gives a command in the chat, and the agent opens websites, fills out forms, logs into accounts, applies promo codes, and completes purchases on its own. Key facts:
- Launch: September 8, 2026, initially only in the USA, on iOS, Android, and the web, for users aged 18 and over.
- Where it works: each user has their own virtual machine in the Meta cloud with a Chromium-based browser. The agent's activity can be monitored in real time.
- Pricing: a free tier plus subscriptions for $20 and $100 per month.
- Payment: purchases are confirmed by a person, while the agent pays through Link — a Stripe wallet for agents that issues a one-time card number.
- Reach: according to Sensor Tower, cited by Inc., the app has been downloaded over 2.5 million times.
Meta named Stripe, Shopify, Best Buy, Gap, Sephora, Walmart, Wayfair, Expedia, Instacart, GitHub, and Notion as partners. However, the main point is that Muse is designed to operate even where there is no partnership: Meta explicitly states that the agent uses services without APIs through the browser, "just as a person would."
Why Muse is being blocked: an agent without an identity
The short answer: Muse disguises itself as a regular visitor and does not identify itself in any way. For anti-bot systems, this is the worst combination.
Visible disguise
Inc. journalist Jason Aten described how Muse launches Chrome with automation features disabled: it hides the navigator.webdriver property, substitutes fake values for browser plugins, and checks pages for captchas and Cloudflare error codes. This is a classic set of "stealth" techniques from the world of headless browsers. The problem is that such techniques only work until vendors adapt their detection methods — and they adapted in just a few weeks.
Fingerprint, in its analysis from October 6, states: many AI agents identify themselves through user-agent or Web Bot Auth signatures, while Muse does not provide verifiable identity, changes the browser fingerprint, and suppresses automation flags. In their API response, such traffic is now marked as bot_type: "meta_muse", category ai_agent, confidence high. An important detail: Fingerprint labels it as "bad" not due to proven harm, but specifically for the lack of declared identity.
Amazon's position
Amazon explained the block for three reasons: Meta did not warn that the agent would access the site; Muse does not identify itself while browsing; the agent could apparently intercept and store customer credentials. Meta responded that Muse does not see passwords or payment details, and accounts are stored in a secure vault. Muse users on Amazon now see a warning window stating that access by an unauthorized AI agent violates the Conditions of Use. According to The State of AI, Amazon's terms since August require agents to identify themselves in every request.
Amazon has a long history with agents: the company is suing Perplexity over the Comet agent, and this dispute has already reached the appeals stage. We discussed the legal side — what constitutes "access" under the CFAA — in detail in the article Amazon v. Perplexity: who "accesses" a website.
Who else has closed the door
TechCrunch gathered the positions of companies that Muse users have complained about on October 6:
- Yelp does not allow non-human traffic unless the agent pays for access through a data licensing program.
- eBay does not ban all shopping agents but restricts unauthorized agents, scraping, and model training. Two users reported that eBay blocked their accounts for using agent AI.
- Zillow allows agents acting on behalf of consumers but acknowledges that anti-bot protection sometimes blocks them.
- Delta has no partnership for bookings by third-party agents, while United refers to terms that prohibit bots without written permission.
- Walmart — an official partner of Muse — stated that the blocks were unintentional: the agent stumbled over the "I am human" verification button.
Jessica Lessin, founder of The Information, wrote that in two days, "half of her use cases" for Muse had "disappeared." Jefferies, which checked hundreds of e-commerce sites, airlines, travel agencies, hotels, and booking services, noted that new restrictions appeared "almost daily," concluding that the bottleneck for agent commerce is access to websites, not the quality of the model.
The role of Cloudflare
Some of the denials may not even be the decision of a specific store. Since September 15, Cloudflare has been blocking agent traffic on ad pages by default for new domains, and sites with the old setting "block AI bots" have been switched to the same policy. Detailed information about this change can be found in our article Cloudflare blocks AI crawlers on ad sites. According to The State of AI, in October, a separate entry for Meta Muse appeared in Cloudflare's catalog of AI bots. Cloudflare itself told TechCrunch that it has no specific data on blocking personal agents, so no direct connection has been confirmed yet — but the timing coincidence is obvious.
What will happen: a signature instead of disguise
The industry is moving towards "good" agents identifying themselves rather than hiding:
- Web Bot Auth — a draft IETF standard under which an agent cryptographically signs each request and proves which operator it belongs to. Unlike a user-agent string, such a signature cannot be forged.
- Industry protocol agent — business: according to TechCrunch, Meta, Walmart, Stripe, Sierra, Genesys, Rocket, NiCE, and Decagon are developing an open standard for agent communication with stores to distinguish good bots from bad ones.
- Direct connectors: Meta is negotiating with brands one by one — Walmart, Best Buy, Wayfair, Sephora, Dick's Sporting Goods — but many integrations are not yet launched. Shopify has opened Muse checkout through Shop Pay.
Meta's position is formulated as follows: denying a personal agent means denying the customer behind it. Stores are still responding that the customer can come themselves.
What this means for those automating the browser
The story of Muse is a clear test for anyone using Playwright, Puppeteer, browser-use, or anti-detect browsers. If Meta, with its resources, could only disguise itself for a few weeks, a custom script has even less chance. Practical conclusions:
1. Flag disguise is not a strategy
Replacing navigator.webdriver and plugins is recognized by inconsistencies: the browser fingerprint, TLS handshake, and behavior must tell the same story. If you modify individual properties while leaving the rest "machine-like," the detector sees a contradiction. Consistency across the entire profile is needed, not just a patchwork of fixes.
2. Cloud VM is visible by IP
Muse operates from Meta's cloud, meaning from data center ranges where regular customers do not sit. Anti-bot systems assess the reputation of the address before the browser fingerprint. For tasks where you act on behalf of a real user — your accounts, price monitoring in a personal account, testing your website — requests should come from an address typical for that audience. For this, residential proxies with home IPs from the required country or mobile proxies from telecom operators should be used if the script is mobile.
3. An account is more valuable than a request
The case with eBay shows: not only the request is punished, but also the account. If the agent logs into an account, keep a stable pair of "profile + IP" for it — a sticky session with one address, rather than rotating with each request. Changing the country and provider in the middle of a session is one of the strongest signals of account takeover.
4. Platform rules are more important than technology
Amazon, United, and Yelp explicitly prohibit unauthorized agents in their terms of use. No proxy makes a violation of the terms legal, and case law regarding agents is still developing. If a platform has an official API, partner program, or data licensing — it is more reliable than racing with a detector.
5. Be prepared to identify yourself
For public agents and crawlers seeking long-term access, the focus is shifting towards signed requests. We described how this works technically in the article about Web Bot Auth and signed agents.
Conclusion
Muse has become the first mass consumer agent that has faced not the limitations of the model, but the doors of websites: Amazon blocks it, eBay bans accounts, Fingerprint and Cloudflare assign separate labels to it. The lesson is universal. An agent pretending to be a human but revealing itself through a cloud IP and a tweaked browser loses. The winner is the one who either honestly identifies themselves and negotiates with the platform or acts on behalf of a real user with a consistent profile, an address from the right network, and within the site's rules.