Meta Muse Hit 10M Users in 40 Days. It Doesn't Identify Itself, Can't Be Blocked by robots.txt, and Never Clicks Your Ads.

On the night of September 20, 2026, Amazon put up a wall.

Shoppers using Meta's brand-new Muse agent started hitting a popup: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Amazon's stated objections were specific — Meta never sought authorization, Muse "appears to capture and store customer credentials," and, most interestingly for anyone who runs a website, Muse does not identify itself as an automated agent while browsing.

Here's the part that should get your attention. Amazon's robots.txt is one of the most aggressively maintained on the internet: roughly 101 user-agent blocks, nearly all of them carrying Disallow: /. Meta appears in it three separate times — meta-externalagent, meta-externalfetcher, meta-webindexer. All fully denied.

None of them is Muse.

Amazon, with the most comprehensive bot-blocking file on the web and an entire department of people who think about this, had no name to put in the rule. So it blocked the agent with a legal document aimed at the human instead, and some behavioral detection method it has declined to explain.

That's the story. Not "AI agents are coming" — we've written about agent traffic and agentic commerce before. The story is that the single most-adopted consumer agent in history arrived with no identity, inside your users' logged-in sessions, driving a real browser, and the entire control layer the web built for robots does not apply to it.

The Adoption Numbers Are Not Normal

It's tempting to file this under "another AI assistant launch." The data says otherwise.

And then the number that matters for anyone with a product page. On October 21, Meta confirmed 10M+ users and said shopping is a top activity — with over 25% of engaged shopping users averaging purchases above $200. Zuckerberg relayed that Plaid, the payments connector, reported it "hadn't seen activity like they're seeing with their connector on any other service before."

Real money, at real volume, moving through a surface that is not a browser you designed for.

Why Muse Is a Different Animal

Most "AI agent" traffic you've dealt with so far is a fetcher. ChatGPT or Perplexity grabs your page, extracts text, cites you or doesn't. Annoying to optimize for, but legible: it announces itself, it reads, it leaves.

Muse is architecturally different in four ways that each break a different assumption.

1. It runs a real browser, not a scraper. Muse operates inside a dedicated "Muse Secure VM" in Meta's cloud, with its own current Chromium-based browser. It reaches services through built-in connectors and APIs where they exist, and falls back to browsing your actual website when they don't. For the overwhelming majority of sites, that fallback is the only path. So your real page, with your real JavaScript, gets driven by something that isn't a person.

2. It's inside an authenticated session. This is the one that defeats conventional controls. Muse acts within the user's own logged-in account. From your server's perspective it is a session belonging to a real customer who really did agree to your terms, arriving over a current Chromium fingerprint. There is no anomalous crawler signature to key on.

3. It persists. Muse keeps working after the user closes the app. Tasks are long-running by design — comparison shopping across sites, monitoring for a price, negotiating a bill. It learns from past conversations and makes unprompted suggestions. This is a visitor that can be mid-task on your page hours after the human stopped paying attention.

4. It transacts. Muse can send emails, fill forms, book travel, negotiate bills, and buy things — gated by a permission layer Meta calls Sentinel, which governs which services the agent can reach and distinguishes read from write access. Sensitive actions require human-in-the-loop approval. On September 23, Meta added a Realtime Avatar model, the ability to control macOS applications, an email address of the agent's own, and a palm-sized hardware device called Muse Charm.

The Identity Problem, And Why It's Yours Now

Every control the web has for managing non-human traffic starts with a name.

robots.txt works by naming a user-agent token and declaring what it may fetch. llms.txt tells AI systems who you are. Web Bot Auth — the IETF draft for cryptographically signed agent requests — binds an identity to a key. All three require the agent to declare itself.

Meta's published crawler documentation lists five agents. Muse is not among them. There is no token. Which means:

• You cannot block Muse in robots.txt. There's nothing to type.
• You cannot allow it either — no allowlist entry, no rate-limit exception, no special handling.
• You cannot verify it. No published IP ranges, no signing identity.
• Your analytics will not separate it. It looks like Chrome, because it is Chrome.

Compare this to how Google handled the identical problem. Google added Google-Agent to its official crawler list on March 20, 2026 — a user-triggered fetcher that browses on behalf of users doing product research, form filling, and cross-site comparison. It ships a user-agent string containing compatible; Google-Agent. Google publishes verifiable IP ranges in a user-triggered-agents.json file. And it's experimenting with Web Bot Auth, signing requests under the identity https://agent.bot.goog so the string can't be spoofed.

Google also tells you something honest: because the fetch was requested by a human, these user-triggered fetchers generally ignore robots.txt. Which is the correct behavior — the user asked for it, and you'd never robots.txt-block a human's browser.

That's the real distinction, and it's worth being precise about it. The issue isn't that Muse ignores robots.txt; Google-Agent does too, by design. The issue is that Google gave site owners an identity to reason about — logs you can segment, IPs you can verify, a name you can discuss — and Meta didn't. One of these companies treated the agentic web as something to build with publishers. The other shipped to 10 million people and let Amazon find out by looking at its traffic.

The Strategic Fork: Amazon vs. Walmart

Six weeks after Muse launched, the two biggest retailers in America had taken opposite positions. This is the most useful thing to study, because it's the same decision you now face at a smaller scale.

Amazon blocked. Anti-bot wall, Conditions of Use enforcement, no agent access. The logic isn't hard to reconstruct: an agent that picks products and checks out routes straight around sponsored listings, and Amazon's advertising business is estimated at roughly $56 billion. An agent that shops perfectly is an existential threat to a business model built on influencing imperfect shoppers.

Walmart built a front door. On October 21, Walmart announced an Agent Gateway — an MCP server that approved agents connect to directly, giving them a faster and more reliable path than scraping the human website. Alongside it: Agent Profiles, where customers authorize each agent with its own profile inside their account, see agent purchases separately from their own, set spending limits, require per-transaction approval, and delete the profile whenever they want. Walmart published terms: agents don't get payment information, only access data needed for the task, can't act beyond user intent, and get blocked if they don't comply. Meta's Muse, ChatGPT, and Gemini are all on the approved list. CEO John Furner framed it as preparing for "a world where AI agents become mainstream."

Notice what Walmart actually did. It didn't choose between blocking and being scraped. It built a third option: a structured, permissioned, observable interface that is better for the agent and better for Walmart than the agent fumbling through a page built for humans.

You probably aren't shipping an MCP server this quarter. But the principle scales all the way down: the winning move is to give the agent a clean path to the thing it needs, so it doesn't have to improvise on a surface you designed for eyes.

The Ads Problem Nobody Wants to Say Out Loud

Zuckerberg has said Meta expects to monetize Muse by taking a small fee on transactions rather than showing advertising. Meta also says Muse data doesn't flow into its ad systems.

Sit with the second-order effect. An agent-mediated session has no ad impressions in it. Muse doesn't see your display ads, doesn't click your sponsored results, doesn't get retargeted, and isn't moved by the social proof you spent six months accumulating on a competitor's comparison page. It reads structure and executes a task.

Today that's a rounding error against your paid traffic. But the growth rate above isn't a rounding error, and the direction is one-way. Every percentage point of purchase intent that migrates into an agent session is a percentage point that exits the auction entirely.

Which means the durable asset shifts. Not ad creative — being the answer, in machine-legible form, on a page an agent can operate. That's the same underlying bet as generative engine optimization, except now the agent doesn't just cite you. It buys.

What Muse Actually Needs From Your Page

Here's the part you can act on this week. Two categories, and most teams only think about the first.

Readable: can it find the facts?

Agents complete tasks by extracting structured information. Machine-readable beats persuasive.

• Price, availability, hours, and policies in real HTML text. Not in an image, not injected by a script after an interaction, not inside a PDF. If a fact only exists after a click, it may as well not exist. This is the single most common failure.
• Answer-first paragraphs under clear headings. One h1, a logical heading hierarchy, and the answer in the first sentence rather than the fourth.
• JSON-LD that matches reality. Organization or LocalBusiness on the homepage; Product and Offer on product pages; FAQPage where you have genuine Q&A. Our schema markup guide covers which types actually get used.
• An honest llms.txt indexing your key pages. It won't gate Muse, but it's cheap and it's the file the ecosystem is converging on. See our llms.txt guide.
• Key facts outside interstitials. A cookie wall, email-gate, or region modal that blocks a human blocks an agent too — and the agent won't persist through it the way a motivated human will.

Operable: can it actually do the thing?

This is the category that's new, and it's where most pages fail hardest.

• Every button and input needs an accessible name. Agents navigate the accessibility tree, not your visual design. An icon-only button with no aria-label is a blank node. A beautiful custom div-based "button" with a click handler is not a button to an agent. Use real button, a, nav, and label elements and the semantics come free.
• Stable layout. Layout shift makes agents click the wrong element. Your CLS score was a ranking factor; now it's a correctness factor. Late-loading banners that push the primary CTA down are actively hostile.
• Guest checkout and plain form flows. Multi-step wizards with client-side-only state, drag-to-confirm interactions, and custom date pickers are where agent tasks die.
• Labeled form fields with sane autocomplete attributes. An agent filling a form is reading field names. placeholder text is not a label.
• Don't hide specs in carousels or tabs. If the comparison table is behind a tab that requires a click, assume half of agents never see it.

You Don't Need a Partnership

A thing worth correcting, because it causes the wrong conclusion. Meta launched Muse with commerce partners — Stripe, Shopify, Best Buy, Gap, Sephora, Walmart, Wayfair, Expedia, Instacart, GitHub, Notion, with 1Password coming. It's easy to read that list and conclude agentic commerce is a big-logo game you'll get invited to in 2028.

It isn't. Muse ships with Stripe's Link wallet for agents built in. At the million-plus businesses that accept Link, Muse checks out with the consumer's saved payment method. And for every other merchant, Link generates a single-use virtual card scoped to the approved purchase.

Read that again. Muse can buy from you right now, with no integration, no partnership, and no awareness on your part — by typing a virtual card number into your normal checkout form.

Which means the deciding variable is not whether you're on a partner list. It's whether your checkout form can be completed by a non-human operator. If your payment step depends on a custom card-number input that fights paste, or a CAPTCHA, or a three-step flow with client-side-only validation, you will lose those transactions silently. No error, no support ticket, no analytics event. The agent will tell its user that it couldn't complete the purchase and move to a competitor whose form worked.

That's the most expensive sentence in this post. Go test your own checkout by pasting a card number instead of typing it.

Detecting Agent Traffic Without a User-Agent

You can't segment Muse by name. You can look for its behavioral signature, which is genuinely distinctive. In your logs or GA4, look for sessions that combine:

• Near-zero dwell before the first meaningful interaction. Humans orient for a second or two. Agents read the DOM and act.
• No mouse movement or scroll events, but real clicks. Agents dispatch events directly. If you record scroll depth, agent sessions look like a teleport.
• Perfectly efficient paths. Straight to the pricing page, then to checkout, with none of the back-and-forth of a human comparing.
• Datacenter IP ranges on sessions carrying a current desktop Chromium fingerprint. Muse runs in Meta's cloud, not on the user's phone.
• Odd timing. Long-running tasks continue after the human closed the app — 3am activity on a consumer product.
• Form fills that are too fast and too clean. No corrections, no tab-order wandering, paste-shaped input.

Build a segment on two or three of those in combination and you'll have an imperfect but directionally useful view. Which brings up the thing that will quietly corrupt your decisions if you ignore it.

Should You Block It?

You mostly can't, so the real question is what posture to take where you do have leverage. A straight framework:

One more consideration before you take Meta's assurances at face value. Muse's track record in its first six weeks includes: an October vulnerability where shared Muse chats were discoverable via passive DNS and subdomain enumeration (Meta suspended the feature after disclosure); September reporting that phone calls attributed to Muse during beta were actually handled by human call-center workers, described internally as a "human agent layer"; and Amazon's claim about credential handling, which Meta disputes. Meta says each user's agent runs in an isolated VM, that it has no visibility into passwords or payment methods, and that a workspace version Meta cannot observe is coming before the end of 2026. Queries are used for model training by default, which users can disable.

None of that means don't serve agent traffic. It means don't assume the permission model is airtight, and keep your own authorization boundaries where they belong.

The 10-Point Muse-Readiness Audit

Run this against your highest-value page. Each item is a yes or no.

1. Is your price in HTML text on the page, without a click, without an image, without a script injection?
2. Does every interactive element have an accessible name? Open your browser's accessibility inspector on your hero and look for unnamed nodes.
3. Are your buttons real button elements and your links real a elements with href?
4. Can you complete your primary conversion with the keyboard alone? If you can't tab through it, an agent probably can't drive it.
5. Does your checkout accept a pasted card number without fighting the paste event?
6. Is guest checkout available, or does every purchase require account creation?
7. Is your layout stable on load? Check CLS — treat anything above 0.1 as an agent-correctness bug, not just a speed one.
8. Are your key facts outside modals and interstitials? Cookie wall, email gate, region selector — can a first-time visitor read your pricing without dismissing anything?
9. Is your JSON-LD present and accurate? Specifically: does the price in your Offer schema match the price on the page today?
10. Does your page state who it's for and what happens next, in plain text, in the first screen? Agents extract and summarize; vagueness becomes a worse summary.

If you score below 7, the fastest wins are almost always items 1, 2, and 8 — facts in text, accessible names, and nothing important trapped behind a modal.

What Actually Changed

For twenty-five years, the deal was: crawlers declare themselves, you decide what they get, and robots.txt is the contract. That deal held because machines reading your site and humans reading your site were clearly different populations doing clearly different things.

Muse ends that cleanly. It's a machine, operating a human's browser, inside the human's session, with the human's money, on the human's instruction. There is no honest way to classify it as a bot — and Meta's choice not to name it means there isn't even a dishonest way.

The useful response isn't a blocking strategy. It's accepting that your page has two kinds of visitors who need different things from the same HTML: a human who needs to be persuaded, and an operator who needs to be able to act. Those goals mostly don't conflict. A page where the price is visible, the buttons are labeled, the layout holds still, and the next step is obvious is a better page for both.

The sites that figured this out first mostly weren't thinking about agents at all. They were just good at accessibility and clear about pricing. That turned out to be the same thing.

Where to Start

The honest answer is that most pages fail this audit for reasons that also cost them human conversions — buried pricing, vague headlines, CTAs that don't say what happens next. Agent-readiness and conversion-readiness are closer to the same project than anyone expected.

If you want a read on both at once, run your page through roast.page. You'll get an eight-dimension breakdown — hero, copy, CTAs, trust signals, visual design, structure, technical and SEO signals, differentiation — with a priority-ordered fix list, in about 30 seconds, no signup. The technical dimension pulls real Lighthouse data, including the CLS number from item 7 above.

For the wider picture, see our guides on agentic commerce, AI browsers, WebMCP tool contracts, and tracking AI traffic in GA4.