The Ninth Circuit Just Ruled Your AI Shopping Agent Is You

TL;DR

On Tuesday the Ninth Circuit reversed the preliminary injunction that had kept Perplexity's Comet shopping agent off Amazon since March. Writing for a three-judge panel, Judge Milan Smith held that Amazon is unlikely to win its claim under the Computer Fraud and Abuse Act, because "it is the user who 'accesses' Amazon's computers" when an agent shops on their behalf, and warned that an injunction "would impair consumer choice and needlessly limit development of a nascent technology." It is the first federal appeals court ruling on whether AI agents acting for users can lawfully access a platform that objects, and it lands squarely on the side of the agents.

Nine months from complaint to reversal

Amazon sued Perplexity last November, accusing the startup of covertly accessing private customer accounts through Comet, the browser whose built-in agent can log into a user's Amazon account, browse listings, and place orders on their behalf. The lead claim was the CFAA, the 1986 federal anti-hacking statute, which prohibits accessing a computer without authorization.

In March, Judge Maxine Chesney of the Northern District of California agreed enough to grant a preliminary injunction, finding Amazon had presented strong evidence that the agent violated the law, and Comet's agent has been banned from Amazon ever since. Tuesday's 21-page opinion undoes that.

Both sides said exactly what you would expect. Amazon: "We respectfully disagree with today's decision on the preliminary injunction. We remain confident in our case and are evaluating our next steps." Perplexity: "Perplexity will continue to fight for the right of internet users to choose whatever AI they want. We have always been confident the truth will prevail."

Where the access actually happens

The whole case turns on one word in a statute written when an "agent" was a person with a briefcase. The CFAA punishes accessing a computer without authorization. Amazon's theory was that Perplexity's software is the thing doing the accessing: an unauthorized commercial bot wearing a customer's credentials.

The panel rejected that by looking at the plumbing. Comet's agent drives the user's own logged-in browser session. Pages render in that session, screenshots go up to Perplexity's servers, instructions come back down, and the clicks happen as the signed-in customer. Smith wrote: "It is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com." Receiving screenshots and sending back instructions, the court said, is not Perplexity accessing Amazon's servers at all.

If that mechanism is hard to picture, think of a driving instructor in the passenger seat: they read the road over your shoulder and tell you where to turn, but your hands never leave the wheel. The panel's holding is that, as far as the CFAA is concerned, the learner is driving. Perplexity's cloud never touches Amazon's servers; it coaches a session that was authorized the moment the customer logged in.

Why this is bigger than shopping

Every browser-driving agent has the same unresolved question hanging over it: when your software clicks through a platform that has told you to go away, is that a federal crime? OpenAI, Anthropic, and a long tail of startups all ship agents that operate websites on a user's behalf, on platforms whose terms of service never imagined them. This is the first time a federal appeals court has answered, and the answer defangs the scariest statute in the room. The CFAA is a criminal law; losing it as a theory demotes the fight from "hacking" to ordinary civil claims about contracts and trademarks.

The ruling also extends a familiar Ninth Circuit lineage. In hiQ v. LinkedIn, the same court said scraping public data was likely not a CFAA violation, and the Supreme Court's Van Buren decision narrowed what "exceeds authorized access" can mean. Those cases were about reading the open web. This one is about acting on the authenticated web, with the user's own credentials, and the court still put the access on the user's side of the ledger. For agentic commerce, that is the more consequential half of the internet.

Venue makes it sting more: the Ninth Circuit is the appeals court for California and Washington, which is to say for nearly every platform an agent would want to shop on, including Amazon's own backyard.

What Tuesday did not settle

• This was a preliminary injunction appeal. The panel ruled on Amazon's likelihood of success, not the final merits. The lawsuit continues in Judge Chesney's courtroom.
• Amazon says it is "evaluating our next steps," which can include seeking en banc review by the full Ninth Circuit or petitioning the Supreme Court.
• The opinion addresses the CFAA theory. Amazon's other claims are still live, and platforms retain contract, trademark, and unfair-competition angles against agent vendors.
• Nothing here obliges Amazon to make agents' lives easy. Bot detection, rate limits, and CAPTCHAs remain legal and very much deployed.
• The holding binds the Ninth Circuit. Another circuit could read the CFAA differently, and a split would tee this up for the Supreme Court.

Key Takeaways

• The Ninth Circuit on August 4 reversed the March injunction that banned Perplexity's Comet shopping agent from Amazon.
• Judge Milan Smith's 21-page opinion holds that the user, not Perplexity, "accesses" Amazon's computers under the CFAA when an agent acts on their behalf.
• It is the first federal appellate ruling on whether user-directed AI agents can lawfully access platforms that object, and it removes the criminal anti-hacking statute as the platforms' lead weapon.
• The mechanism mattered: Comet drives the user's own logged-in session, and screenshots plus instructions to Perplexity's cloud do not count as Perplexity accessing Amazon.
• The case is not over. The merits continue at the district court, Amazon is weighing its options, and platforms can still fight agents with contracts and countermeasures.

Sources: Reuters via Yahoo Finance, MediaPost, Bloomberg Law