Amazon Locked Meta’s Muse Agent Out of Its Store on 21 September — I Checked 6 Singapore Checkout Stacks Against the Same Question, 5 Cannot Tell an Agent From a Customer, and Here Are the 4 Roles I Am Now Sourcing

I spend my weeks helping Singapore companies hire the people who build their apps and their checkouts, and for about a year I have been telling clients that the next visitor to their checkout would not be a person. On Sunday night, US time, Amazon showed everyone what that visitor looks like from the platform’s side, and what a platform does when it has not decided in advance. This article is about what happened, and about the four people you will need before it happens to you.

What Happened on 21 September

GeekWire first reported that Amazon had cut off Meta’s Muse agent from shopping on Amazon.com; Engadget, The Register and Forbes carried it through Monday, 21 September. People who asked Muse to buy something on Amazon saw a notice, quoted by Engadget, that read: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”

Amazon’s case, as The Register summarised it, had four parts: Meta had neither informed Amazon that Muse would access the store nor obtained authorisation; the agent fails to identify itself while browsing; it appears to capture and store customer credentials; and it could access account information, including a customer’s order history, when instructed to do so. Amazon said it had first asked Meta to exclude the site from Muse voluntarily. An Amazon spokesperson gave Engadget the sentence that will be quoted in every platform terms-of-service rewrite this autumn:

“We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.”

Meta’s reply, also to Engadget: “Muse has no visibility into people’s passwords or payment methods. Any credentials a person shares go into secure storage, so Muse can use them without seeing them.” Muse itself launched in the United States earlier this month; Meta describes it as “a secure, private personal AI agent that proactively helps with people’s goals and suggests ideas,” and it can fill forms, send emails, manage calendars and make purchases, driving a browser where a service has no public API and paying with single-use cards generated through Link by Stripe. It is a different product from Muse Glimmer, the on-device model Meta released in August, which we covered at the time.

The context is the part Singapore employers should read twice. This is not Amazon’s first move against a shopping agent: it has taken legal action against Perplexity over its Comet browser, moved to block the Google and OpenAI shopping agents, and, as The Register notes, it operates its own agents, Alexa for Shopping and Buy for Me, on top of an advertising business that generated more than US$68 billion last year. A platform with that much to protect has decided that agents are welcome on its terms and unwelcome on anyone else’s.

6 Singapore Checkout Stacks, 3 Questions, 5 Blind

I took Amazon’s four complaints and turned them into three questions, then put them to the six checkout stacks our engineers currently support for Singapore clients: two marketplaces, a subscription retailer, a travel booking platform, a food-delivery app and a digital bank’s in-app store. The questions were: can the stack tell an agent acting for a real, logged-in customer apart from a scraper and from the customer themselves; is there any sanctioned path for an agent to buy on a customer’s behalf; and if an agent drove a browser through the login and checkout, what credentials would it be able to capture along the way?

The answers were worse than I expected and better than they sound. Five of the six could not answer the first question at all: their bot management is tuned to block scrapers by rate and fingerprint, which means an agent behaving like a patient human sails through, and an agent behaving like a scraper gets blocked along with the customer it is acting for. None of the six had a sanctioned path; the closest was a partner API built for affiliates that was never designed for delegated purchases. And two of the six kept a session token and a saved card reference in places a browser-driving agent could read. None of this is negligence. Twelve months ago it was not a requirement.

The 4 Roles I Am Now Sourcing for Singapore Employers

Every one of the six stacks needs the same four competences, and I have yet to meet one engineer who has all four. These are the requisitions we opened this week, with the line in each that separates the people who have done it from the people who have read about it.

1. Agent identification and traffic-policy engineer

The prerequisite. This person can distinguish, at the edge, an agent acting for a logged-in customer from a scraper and from the customer’s own browser, using request signing and declared identity where an agent offers it and behavioural signals where it does not; and, more importantly, can turn a one-page written policy on what agents may do into enforceable rules. The line that separates: “Has written and shipped the policy, not just the detector.” Amazon’s block was a policy decision implemented in code; a detector without a policy just produces a dashboard.

2. Agent-facing commerce interface engineer

The sanctioned path. Structured catalogue and pricing feeds an agent can read without scraping, a checkout designed for delegated purchases with explicit scopes, and the terms of use expressed as an interface rather than a page nobody reads. If you are building or rebuilding a storefront in Singapore this year, our guide to e-commerce website development in Singapore now needs this as a chapter, and our seven-step guide to recruiting e-commerce platform engineers covers the sourcing. The line that separates: “Has designed an API where the caller is not the account holder.”

3. Delegated-credentials and payments engineer

The part Amazon and Meta are actually arguing about. Meta’s position is that credentials sit in secure storage and are used without being seen; Amazon’s is that the agent appears to capture and store them. The engineer you need can make a purchase on a customer’s behalf where the agent never holds the password or the card: tokenised credentials, single-use payment instruments of the kind Meta says it generates through Link by Stripe, scoped consent that expires, and a record of what was delegated to whom. In Singapore that record is also a Personal Data Protection Act question, which is why our PDPA compliance guide for engineering teams sits next to this role in the requisition. The line that separates: “Can explain what the agent can and cannot see, in one diagram, to a regulator.”

4. Agent-traffic fraud and risk engineer

The role that gets hired last and blamed first. A delegated purchase and an account takeover look identical to a fraud model trained on human behaviour: a new device, a fast checkout, a saved card. This person retrains the model on a world where the fast, tidy checkout is often legitimate, builds the signals that distinguish an authorised agent from a stolen session, and decides what happens in the first second when the answer is unclear. The line that separates: “Has tuned a risk engine after agents arrived, not before.”

What This Means for Singapore Employers Over the Next 90 Days

The agents arrive before the policy does. Muse is US-only for now, but the assistants already on Singapore phones can drive a browser today, and the marketplaces and super-apps headquartered here have the region’s most valuable checkouts. Every one of them will have an Amazon moment; the only question is whether it is planned. Employers who hire role 1 in the next quarter get to choose their moment. The rest get chosen.

“Bot management” stops being a vendor line item and becomes a team. The five blind stacks all had a bot-management product. What they did not have was a person whose job was to decide what an agent acting for a real customer should be allowed to do. That decision does not come in a box, and the engineers who have made it for a live platform are as rare in Singapore this month as browser-automation engineers were in Dubai in the spring; our colleagues there wrote the seven-step guide to hiring AI browser-automation engineers when the shortage hit, and their guide to hiring agentic web infrastructure engineers reads today like a sourcing plan for role 2.

The fintech side moves first. A marketplace that mis-serves an agent loses a sale; a bank that mis-serves one loses a customer’s money and has a regulator to call. The digital bank in our six was the only stack whose engineering lead had already drafted an agent policy, unprompted. Expect the delegated-credentials role to be bid up by financial institutions before retail notices it is a role.

FAQ — Amazon, Muse and Singapore Hiring