Who decides what your agent is allowed to buy

Twenty-three of the 84 agents you can text say they will spend your money, and the industry has spent the year solving the payment. Wallets that hand over a one-time card, aliases that keep the real number out of the agent's context, a checkout embedded on launch day. The record here says the payment is the easy part. On 23 September 2026 an investor's agent went to buy a bar of soap and came back with a list of four merchants, three of which would not let it in.

The soap

Walmart was cheapest at about $25.68 all-in, arriving the next day, and checkout needed a sign-in. Target had it at $17.49, threw a bot check, and also needed a sign-in. Amazon was, in the agent's own words, fully blocked for agent browsing. The manufacturer's own site was ready to go at $31.78 with no account needed, which is the only door that was open and the most expensive room behind it.

He bought it on Amazon himself for $18.50, free shipping on Prime, and posted the checkout beside his agent's list. The gap between the price his agent could reach and the price he could reach by hand was $13.28 on one bar of soap, and none of it was a payment problem. The card worked everywhere. The door did not open.

The doors, as the record has them

Two days earlier the same story arrived without a number. An investor posted a screenshot and the line "Amazon cuts off Muse", and read it as the start of a fight over who stands between a customer and a store. He has two purchases on this site's record himself, a jacket bought at the cheapest price his agent could find and a Whole Foods cart loaded from a recipe. Neither company has published anything.

The doors open unevenly, which is the part a directory can show. On 14 September a user gave the same job to two agents and reported that Muse completed a Ticketmaster purchase where Instinct had failed. Ticketmaster is the checkout with the most bot defence in consumer commerce, so that outcome is a fact about whose browser gets through rather than about which model reasons better.

On 8 September Shopify's own account said its merchants were live inside Muse on launch day, the one retailer in this record that opened a door rather than closing one.

A user probing Muse on Facebook Marketplace reached the conclusion this piece is about, before anybody had been blocked:

Then the doors started opening on the other side of the same week. On 22 September Expedia said it was joining Muse, and Instacart said Muse was the newest member of a connector programme that already reaches ChatGPT, Claude, Gemini and Google's AI Mode. PayPal and Shopify were already there.

None of the four announcements names a date, and Muse's own pages name none of the four. What they show is the shape the access question is taking: arranged between two companies, for one agent, rather than won at a login page by any agent.

A reader answered the travel one with the sentence this piece cannot improve on: if the agent just uses an online travel agency, it is not her agent, it is another one of them. Direct booking is what earns the points and leaves somebody to beg when she misses a cancellation window.

The other direction, which came first

The blockade has a mirror image, and on this site it is older. On 6 September an Instinct user's Resy account was deactivated and every future reservation cancelled. His agent had swept one restaurant's availability every ten minutes around the clock, on his account. He published the platform's notice, then his agent's own log, and said the platform was right.

Resy's co-founder then made the argument from the other side, and it is the sentence this whole subject turns on: every request the agent makes is made on a specific person's account, under terms that person agreed to and the agent never read.

So a merchant has two moves. Shut the agent out, and the customer pays more or does it by hand. Let it in and enforce against the account, and the customer loses the account. In both the consequence lands on the person, and neither move requires the merchant to say anything in public. Amazon has published nothing; Resy published a notice to one user.

The field that decides it

When a door asks for a sign-in, what happens next is not about the model. It is about whose browser the agent is driving, and whether that browser can be handed to you.

Ten of the 84 listings here say, and the builder page holds the providers they name. Five name an outside provider, and the recorded pairs are the infrastructure this market actually runs on: Kernel, Browserbase, Anchor, Daytona, Bright Data, a cloud Mac. Eight run their own. The rest publish nothing at all, which means a reader cannot tell what their agent will do when Target asks it to log in.

The difference is not theoretical. When two people gave Muse and Instinct the same restaurant to book, one chose Instinct despite Muse being faster: Instinct drove his own browser, where his payment details were already saved.

The soap agent offered the same escape, sign in to Walmart yourself and it would hand the session over. An agent that cannot hand you the browser has one option at a login wall, which is to give up and quote you the open door's price.

The credential rows say the same thing from the other end. Thirty-four of the 84 listings state what they hold to sign in as you and 37 do not. Of those that answer, 23 take a delegated connection, 3 hold a surrogate rather than the secret, 3 hold a session you started, and 2 take the password itself. A merchant reading that list has an obvious question about which of those it wants arriving at its login page, and no merchant has answered it in public.

What this does to the commerce story

The piece on whether an agent can buy anything was written on 10 September around a public argument about rails: a catalogue to find the product in, a trusted way to pay, a checkout that completes.

Two weeks later the rails are not the binding constraint. Seven listings name the rail they pay on, the wallets shipped, and one-time cards and card aliases work. The sightings where buying failed did not fail at the card.

The prediction on the market wall is that this ends in money: a revenue-sharing arrangement where the agent's owner pays the platform for access, perhaps per user, and that only companies at enormous scale could afford it.

If that is right, the moat this market has been looking for is not in any of the products. It is in the terms of the sites they visit.

What is not known

Whether Amazon blocked anything: one screenshot and one person's reading, and no statement from either company. Whether the block is permanent, general, or one of the throttles every large site runs. What the soap agent would have paid at Walmart had its owner signed in, which is the counterfactual that would size the gap properly. And what any retailer's terms actually say about an agent acting for a logged-in customer, which is a document nobody in this record has quoted.

What to watch

The first retailer to publish terms for agents rather than a block, which turns this from an arms race into a market. A second retailer reported to have cut an agent off, which would make one screenshot a pattern. And whether the listings that say whose browser they drive pass fifteen, because on the day a merchant asks, that is the field that answers.