Your Agent, Their Rules: The Front-Door War Over Consumer AI

In less than two weeks, Meta's Muse unseated ChatGPT as the top free app on Apple's App Store. The app's agent books appointments, shops, and organizes calendars by taking access to accounts across your phone, including your bank account. Instinct, a waitlist-only startup built by founder Noah Shinn, spent the same stretch drawing a soaring valuation on a nearly identical promise: an AI that acts on your behalf everywhere.

Then Amazon blocked Muse from its store entirely.

I have both agents now, and I am testing both. But the story this week is not really about either product. It is about the door they are fighting over.

Two agents knocked on the door at once

Muse uses what Meta calls its Muse Spark model, and its pitch is simple: stop clicking around apps yourself. Give the agent your accounts and let it do the booking, the buying, and the scheduling. Instinct's pitch is the same shape, just earlier and more exclusive: a waitlist, a founder with a reputation for building fast, and a valuation climbing on the promise that everyone will want an AI with hands.

Two consumer agents, launched into the same moment, both asking for the same thing: standing access to your digital life in exchange for convenience.

The block is a business decision, not a security one

Amazon's stated reason for blocking Muse was that continued access by an unauthorized AI agent violates its Conditions of Use, the terms its customers agreed to. Meta never asked permission. So on paper, this is a contract enforcement story.

It is not. Amazon makes its money on the interface: the ads, the recommendations, the storefront a human walks through on the way to a purchase. An agent that shops on your behalf bypasses all of it, and when the agent's maker controls the shopping surface, the ads and the recommendations belong to someone else. Blocking Muse was not a security measure. It was a revenue defense wearing a security costume.

Amazon already lost this fight once

There is precedent, and the incumbent lost. Amazon sued Perplexity over its Comet browser agent, which could access Amazon accounts much as Muse does. The Ninth Circuit found that users were ultimately choosing to access Amazon through Perplexity's tool. Amazon is still fighting, but the ruling stands as a warning: courts may not accept the argument that a customer-authorized agent is an intruder.

Meanwhile, Amazon's own shopping agent, Buy for Me, works much the same way, except that brands are enrolled automatically and have to take action to opt out. The asymmetry is the tell. Access for me, trespass for thee.

Meta's answer to the block was to sidestep Amazon entirely and partner with Shopify, routing Muse's shopping through the merchant side of the web rather than the marketplace that just barred the door.

Every app is about to face an existential decision

Palo Alto Networks CEO Nikesh Arora framed what is coming: it is only a matter of time before there is an Apple and Google version of Muse, possibly a TikTok one, in addition to the frontier-lab agents. Every app that is a services, marketplace, or commerce app will have to decide whether to open its interfaces to consumer agents. Smaller players have no choice. Either the consumer benefits, or the distribution aggregators demand a higher toll.

Liat Ben-Zur, a former Microsoft VP of consumer services, made the sharper point: agents will increasingly act as people's representatives online, and the companies that control the rules of access will have enormous influence over whether those agents actually work for the consumer.

That is the governance gap hiding inside a product launch. If your agent can only shop where the incumbent allows it, the agent works for the marketplace's interests before it works for yours. This is being covered as a rivalry between Meta and Amazon. It is better understood as a negotiation over tolls, and the consumer's seat at that table is not guaranteed.

What you actually hand over

While the giants fight over the doorway, almost nobody is pricing what the consumer surrenders to get through it.

In enterprise security, we spent two decades dismantling standing access. It became a finding in every audit. The standard became time-boxed, scoped, logged credentials, granted for a task and revoked when the task ends. The consumer agent market just inverted that principle and shipped it as a feature.

Meta's own disclosures show the shape of the trade. Logins are kept secret, and purchases use a one-time card number that hides the real card details. Those are real controls, and the payment leg is genuinely better protected than it might have been. But the payment leg is one leg. The agent still reads the inbox that contains the password resets, the account statements, and the itineraries. The sensitive surface is not just the card. It is everything the agent can see while it waits for the next instruction.

And the company holding those keys is the one facing proposed class-action lawsuits alleging that smart glasses footage, including highly personal material, went to third-party human reviewers for annotation and AI development. Meta disputes the allegations. The pattern still matters for anyone deciding how much trust to extend: a platform's privacy posture is a habit, not a press release.

Instinct has drawn the same category of concern since its earliest coverage: broad app permissions, granted broadly, early, and all at once.

Nobody is auditing the grant

Here is the accountability gap that matters more than any single feature. There is no external audit of what these agents touch, retain, or transmit while they act. There is no standard disclosure for the permission graph a consumer is actually accepting. The app-store permission list tells you what the agent can access. Nothing tells you what it did with that access, in plain language, after the fact.

Muse lets you name your assistant, a small design touch that reliably deepens attachment. The warmer the relationship feels, the less any of it feels like infrastructure. That is the point.

What I'm watching for

I now have both agents, and the follow-up piece to this one will be hands-on: what permissions each agent actually requests, what it touches during ordinary tasks, what network calls it makes, and what it sends home. The same way I would evaluate any vendor tooling before it gets near a regulated environment.

The evaluation is underway. The results will be published here separately.

My takeaway

The question is not whether consumer agents are useful. They are, and they are going to be everywhere. The question is whether the access they demand is governed the way credentials are governed everywhere else that matters.

The minimum bar, borrowed from the discipline these platforms would rather not mention: access scoped to a task rather than standing, sessions that expire, activity logs a user can actually read, and payment isolation that covers every leg of a transaction rather than the one that makes the best marketing copy.

Until an agent meets that bar, it is not your assistant. It is a tenant with a copy of your keys, and the landlord is a company you have never audited.

I build tools like CloudDefender's short-lived credential module for exactly this reason. Standing access is a design choice. Companies keep choosing it for you, and calling it convenience.