Amazon Blocks Muse After It Tops the App Store

Meta’s Muse personal AI agent passed 2.5 million downloads by Monday and took the top U.S. iPhone free-app slot. Amazon cut it off from shopping the same weekend Shopify opened checkout.

The ranking is a consumer hit. The argument underneath it is who is allowed to browse, log in, and buy on someone else’s site.

2.5 Million Downloads and a No. 1 Free App

Muse launched in the United States on September 8 on iPhone, Android, the web at muse.ai, and WhatsApp, with AI glasses listed as next. Sensor Tower, the app-intelligence firm, put downloads at 730,000 over about five days, then at more than 2.5 million by Monday, about 1.5 million on iOS and 1.1 million on Android.

It overtook ChatGPT as the leading U.S. free iPhone app on Friday, September 18, and was still ahead on Monday, in front of Grok and Anthropic’s Claude. Meta describes Muse as a personal AI agent that takes action, not a chatbot that only replies. It can keep working after the app is closed, then ping the user when a plan changes or a purchase needs a yes.

DOWNLOADS IN THE SAME 13-DAY WINDOW

Sensor Tower warned that the rival apps had staggered Apple and Google launches, which skews the totals. ChatGPT still led that 13-day count. Muse led the store chart with a smaller pile because charts rank daily demand, not lifetime installs.

Bernstein analyst Stacy Rasgon said most agent tools until now were not really for ordinary people, and that Muse is among the first with a shot at broader use. Other AI apps have spiked on launch and then faded, including OpenAI’s Sora and Meta’s own Vibes video tool. Downloads this early do not prove anyone will still open the app in a month.

Amazon Stopped the Agent at the Cart

On Sunday night, September 20, people who sent Muse to Amazon.com started seeing a popup. It said continued access by an unauthorized AI agent violates Amazon’s Conditions of Use. Amazon said it had already asked Meta to leave the store out of the product, and that Meta never gave notice Muse would shop there.

The retailer’s complaint is specific. It says the agent does not identify itself while it browses, appears to capture and store customer logins, and can open account pages and order history if a user asks. Amazon treats that as an undisclosed third party walking through a customer account.

We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate.

Amazon spokesperson, statement

The same statement said agent apps such as Muse have those obligations, and that Amazon has asked Meta to remove Amazon from the experience. Amazon said it was talking directly with Meta and declined to say whether it would sue. Meta did not issue a fresh reply on the block. Its launch papers still say Muse has no visibility into passwords or payment methods, and that shared logins sit in secure storage the model cannot read.

The two companies still do business. Amazon products have been buyable inside Facebook and Instagram since 2023, and Meta signed a multibillion-dollar deal in April to run agent workloads on Amazon’s Graviton chips. The store is a different fight. Amazon took in more than $68 billion in ads last year, a line that depends on people lingering on Amazon pages and seeing sponsored listings. An agent that compares a stroller and checks out elsewhere cuts that session short.

Amazon has spent a year pushing outside agents off the site, including moves against shopping agents from Google and OpenAI and a lawsuit aimed at Perplexity’s Comet browser. A federal judge first blocked Perplexity, then the Ninth Circuit on August 4 said the shopper, not the AI firm, was the one accessing Amazon’s computers under anti-hacking law. That left contract and terms-of-use claims. The Muse popup cites the Conditions of Use, not a hack. Amazon’s own Buy for Me tool, by contrast, identifies itself and lets brands opt out.

Shop Pay on All Shopify Stores

Shopify took the other door the same Monday. CEO Tobi Lütke said the company is partnering deeply with Muse so people can check out with Shop Pay on all Shopify stores, and called it an easy way to shop inside the agent. Meta’s September 8 launch post had listed Shop Pay as coming soon. Lütke made it a live merchant promise 13 days later.

We are excited to announce we are partnering deeply with Muse to enable agentic checkout with Shop Pay on all Shopify stores, offering people an easy and delightful way to shop and check out with Muse. pic.twitter.com/KmRlKjoLoq

— tobi lutke (@tobi) September 21, 2026

That split is the market’s first hard line on agent shopping. Amazon is keeping an outside agent from crawling a store it owns. Shopify is threading its checkout into the agent so every merchant on its platform can take the order. The loud worry around Lütke’s post was not ranking math. It was the idea of giving a bot a wallet, even when the card is meant to be single-use and locked to one ticket.

Stripe is the other party in that wallet. Link, its consumer network, has over 300 million users. At more than 1 million businesses that already accept Link, Muse can check out with a saved U.S. payment method. Everywhere else, Link issues a single-use virtual card for each purchase, tied to one merchant, one amount, and a short window. Jay Shah, Link’s business lead, said Stripe is building the pipes that let agents buy from businesses. Muse never sees the underlying card, and the person still has to approve the total in chat.

What Muse Can Do Without Seeing a Password

Meta’s pitch is a dedicated cloud computer per person, called Muse Secure VM, with its own browser. The agent can send email, book travel, fill forms, negotiate, turn a saved Instagram recipe into a grocery list, and keep going on a long task in the background. Sensitive steps, including sending mail and paying, are supposed to stop for a human yes. Powering it is Muse Spark, which Meta calls its most capable model for this kind of work.

The Amazon dispute sits on the same design. If a service has an API, Muse connects with logins the user hands over. If it does not, Meta says the agent can use the site through a browser the way a person would. That browser path is what Amazon says it never agreed to host.

HOW MUSE KEEPS KEYS OFF THE MODEL

• Isolated machine: Each person gets a dedicated Linux box in Meta’s cloud, with the agent and that person’s files kept apart from everyone else’s.
• Sentinel gate: A separate host-side agent called Sentinel is the only authority that can let connector actions and network traffic through, so Sentinel must approve every outbound request.
• Surrogate tokens: The model sees stand-in tokens; Sentinel swaps in the real secret at the network edge after a request is allowed, which is Meta’s answer to prompt-injection theft.
• Purchase lock: Checkout uses Link’s one-time card, plus a prompt with the exact total, and Meta says Muse is the first agent covered by Link’s purchase protections on eligible orders.

Tarek Sheasha, a vice president at Meta Superintelligence Labs, wrote that any agent like this will still make mistakes and will sometimes be attacked through the data it reads. The harness is built on the assumption the agent may already be under attack. Meta opened a public bug bounty of up to $300,000, including up to $130,000 for a prompt-injection hit on one user. Later this year it plans Muse Confidential VM, which would encrypt the whole machine with a key only the user holds, so even Meta could not read it.

That is a serious engineering stack. It does not settle Amazon’s point that an unidentified browser with stored logins is still a third party in a customer account. Users also choose which apps to connect and can opt out of having chats used to train Meta’s models. Muse, Meta says, does not share those chats or the VM’s data with Meta’s ad systems.

The Free App Still Has $20 and $100 Tiers

Muse is free for most of what Meta thinks people need. Heavier use sits on two monthly plans, Power at $20 and Maximum at $100. There is no advertising inside the product. Subscriptions, and later commerce cuts, are the path to money that is not feed ads.

The product Muse most resembles is not ChatGPT’s chat box. It is open-source agent that runs locally on a person’s own computer, talks over WhatsApp or Telegram, and keeps state, memory, and secrets on hardware the user holds. OpenClaw, stewarded by a nonprofit, spread among developers earlier in 2026 because it actually did things. Muse sells the same idea with the setup removed: create an account, talk like a person, let Meta host the machine.

That swap is the trade. A local agent is fiddly and you own the keys. A phone app can hit 2.5 million downloads in 13 days, and the keys live in Meta’s cloud until Confidential VM ships. Alexandr Wang, who leads Meta Superintelligence Labs, has said the paid tiers exist to cover compute for people who hand the agent real work. The free chart is the funnel. The $100 plan is the test of whether anyone pays.

Wells Fargo’s $796 Target Meets a Trust Problem

Meta shares jumped more than 11% on Monday. Wells Fargo raised its price target to $796 from $640 and kept an Overweight rating, with analyst Ken Gawrelski pointing at Muse Spark and early Muse traction ahead of Meta Connect on September 23. He wants usage numbers, not another launch video.

THE MONEY AROUND A FREE AGENT

• The stock move: Meta rose more than 11% on Monday after Muse held the U.S. free iPhone slot.
• The new target: Wells Fargo lifted its price target to $796 from $640 and kept Overweight.
• The plans: Muse stays free for most use, with $20 and $100 monthly tiers for heavier loads.
• The store Amazon is guarding: Amazon’s ad business took in more than $68 billion last year.

Rasgon, asked about the data Muse needs, said people care about security and he does not know how much they care about privacy. That line lands next to a separate bill. Meta recently agreed to pay roughly $17 billion to settle with a coalition of state attorneys general over alleged harms to children and teens on Facebook and Instagram, a multistate teen-safety settlement with time caps that still follows the company into a product that wants email, calendars, and saved cards.

Muse is limited to the United States at launch. It asks for a lot of life admin in return for filling a form. Amazon is still in conversation with Meta about whether that agent may shop the biggest store in the country. Shopify already said yes. Connect is on September 23, and the figure that will matter there is not another download total. It is whether the people who installed Muse still let it open a browser.

Disclaimer: This article is news reporting and analysis of Meta’s Muse launch, app-store figures, partner statements, and related market moves. It is for information only and is not investment advice, a recommendation to buy or sell any security, or guidance on using Muse with bank, shop, or email logins. Readers who are considering Meta, Amazon, or Shopify shares, or who plan to connect personal accounts to an AI agent, should speak with a licensed financial adviser and review each company’s own product terms before acting. Download counts, rankings, price targets, and access rules come from the named firms and may change as stores, partners, and regulators move.