Tags
Shopify added WebMCP tools to its checkout on September 28, 2026. An AI agent running in the buyer's browser can read the checkout, change the address, delivery option, discount codes, and payment choice, and place the order once the buyer approves it. Merchants do not have to configure anything.
Shopifyverified
Patrick Wardle found that any application or command on macOS can redirect where Muse sends speech for transcription. Pointing that address at an attacker's server delivers the token that authenticates the user to the account. Meta launched the agent on September 8, 2026 behind a security design it described at length, and it did not answer questions from Ars Technica. Amazon began refusing Muse on its own store on Sunday, September 20, 2026.
Ars Technicaverified
Amazon says it has blocked Meta's Muse from buying on its site for customers, after asking Meta to leave the store out of the product and getting nowhere. Shoppers who send Muse to the site are shown a notice calling it an unauthorized agent and citing Amazon's terms. The objection is not automation: it is that the agent arrived unannounced and does not say who it is while it browses. For anyone building an agent that acts on someone else's site, this is the first clear case fought over terms of service rather than over the federal anti-hacking law.
GeekWireverified
