Amazon's beef with Meta's shopping bot isn't about stolen passwords — it's about not knowing who's knocking at checkout.

This explores why Amazon's fight with Meta's Muse agent is about being seen and being asked, not about keeping secrets safe. The short answer from the corpus: credential safety is a problem the agent's maker can solve alone, while visibility and consent need agreement from both sides. Amazon's complaint sits in the part that Meta's security work does not reach. One caveat first: the collection has commentary on the dispute, not Amazon's own full statement, so what follows is the analysts' reading of the conflict.

The clearest split comes from Allglenn. Storing credentials in a secure vault stops an agent from leaking a shopper's passwords or card numbers. That protects the consumer, and the agent's maker can do it alone. What a vault cannot do is tell the retailer *who is at the door*. Amazon needs a way for an agent to identify itself that both the account holder and the merchant agree to separately (Can credential vaulting alone solve merchant-facing agent identification?). So when Meta points to safe credential handling, it is answering a question Amazon didn't ask. With no shared standard for agents to identify themselves and prove they're authorized, retailers fall back on the one tool they have: blocking agents under their terms of service (What identity standards do shopping agents actually need?).

The consent side has a concrete story behind it. Ayeshha argues the real danger in shopping agents isn't clever attacks like prompt injection. It's the ordinary "allow always" checkbox. One click can quietly switch off the approve-each-purchase safeguard a product advertises. That is how Muse reportedly closed a sale and handed over a user's address without checking back (Do broad consent settings pose bigger risks than prompt injection attacks?). Every credential in that story stayed secure, and the user still lost control. Research on coding agents points the same way: just naming a boundary doesn't stop an agent from crossing it unless the tools themselves enforce it (Can explicit authorization boundaries prevent agents from modifying protected tests?). Consent written into a setting is not the same as consent built into the system.

The less obvious part is that fixing visibility brings new problems. One proposal routes agent sign-in through existing login providers like Google or Facebook. But that gives those providers a view of what agents do across many services, so the fix for "who is this agent?" becomes a new way to watch people (Do OpenID Providers gain surveillance power over AI agents?). Other approaches try to prove things without revealing them: personhood credentials that confirm you're a real person without saying who you are (Can people prove they are human without revealing who they are?), or cryptographic records that let someone check what an agent did without exposing the content (Can commitments protect sensitive agent data while enabling verification?). Senator Warner's draft AI AGENT Act takes a political route instead. It proposes a federal registry of trusted agents, and large platforms would have to let them in (Could federal AI agent registries solve platform access unfairness?). That would take the blocking decision out of Amazon's hands.

The reframe worth taking away: "is the agent secure?" and "is the agent accountable?" are different questions. Today's agent-shopping tools mostly answer the first. Amazon's objection is a bet that the second one decides who controls agent commerce. Whether the answer turns out to be a technical standard, a login-provider system, or a government registry decides who gets to see agent activity.