# Amazon v. Perplexity CFAA: What AI Agent Builders Need > Source: > Published: 2026-09-15 02:12:49+00:00 The Ninth Circuit Court of Appeals handed down the first federal appellate ruling on AI agent liability this August — and developers building agentic software should read it carefully. In *Amazon v. Perplexity*, the court vacated an injunction that had blocked Perplexity’s Comet browser agent from shopping Amazon on behalf of its users. The ruling: when a user directs an AI agent to act on their behalf, it’s the *user* who legally “accesses” the target website under the Computer Fraud and Abuse Act (CFAA) — not the AI company. That’s a meaningful but conditional win for the AI industry, and the conditions matter as much as the victory. ## Why Perplexity Won: The CFAA Architecture That Mattered The technical design of Comet — not abstract legal arguments — is what saved Perplexity from Amazon’s CFAA claims. Comet runs locally inside the user’s browser. When a user asks the Assistant to find or buy something on Amazon, the agent takes screenshots of the browser view and sends them to Perplexity’s servers for processing. Perplexity’s servers analyze the screenshots and send back navigation instructions. Consequently, the user’s device — not Perplexity’s infrastructure — makes every actual HTTP request to Amazon. The court’s reasoning follows directly from that architecture: “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts.” Because the user’s computer was the entity communicating with Amazon, and the user was already authenticated, the court found no unauthorized access by Perplexity. According to the [Jones Day analysis of the ruling](https://www.jonesday.com/en/insights/2026/09/ninth-circuit-vacates-cfaa-injunction-against-perplexitys-comet-ai-agent), this sets a critical precedent: browser-based agent architectures that relay requests through the user’s device hold a distinct legal advantage over agents that contact third-party servers directly from the AI company’s own infrastructure. ## The Court Called AI a Tool. That’s Bigger Than It Sounds. The Ninth Circuit didn’t just rule on Perplexity’s specific product — it established a philosophical baseline. “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes,” the court wrote. The CFAA’s language — “whoever intentionally accesses a protected computer” — requires a human actor. AI software doesn’t qualify. Furthermore, this framing directly shapes how future courts will approach questions of AI agent responsibility across many domains beyond CFAA. The ACLU filed an [amicus brief](https://www.aclu.org/news/privacy-technology/amazon-perplexity-amicus) during the case warning that ruling for Amazon could expose not just AI companies but everyday users of browser extensions and automation tools to federal criminal liability. Moreover, the brief noted that such a ruling could deter journalism and public-interest research. The court’s “tool, not a person” holding avoids that outcome — for now. **Related:** [The AI Agent Governance Gap: You Don’t Own What You Think](https://byteiota.com/ai-agent-governance-gap/) ## What the Ruling Didn’t Fix — and Won’t Amazon’s CFAA and California CDAFA claims were dismissed. However, everything else survived. Trademark claims go back to district court. Terms of Service violations remain a live threat. Direct server-to-server agent access — where your infrastructure contacts third-party systems without routing through a user’s browser — isn’t covered by this ruling at all. In addition, the Ninth Circuit is not the whole country: outside that jurisdiction, there’s no equivalent precedent. According to [Cooley LLP’s analysis](https://www.cooley.com/news/insight/2026/2026-08-06-ninth-circuit-rules-on-ai-agent-access-to-third-party-websites-under-cfaa), this ruling protects the specific architecture where user computers relay all communications — not blanket permission to build agents that ignore platform restrictions. Platforms will respond. Amazon, Google, and others are already tightening ToS language around automated access. Technical countermeasures — bot detection, agent fingerprinting, session monitoring — will follow. CFAA was Amazon’s chosen weapon in this fight. The platforms have others. The [National Law Review analysis](https://natlawreview.com/article/client-alert-when-ai-agent-visits-website-who-really-doing-accessing-ninth-circuit) puts it directly: “Websites cannot rely solely on CFAA litigation to restrict AI agent activity. Contract, platform governance, authentication controls, and technical access restrictions may prove more effective.” In other words, this ruling shifted the legal battlefield — it didn’t end the war. ## The Autonomy Problem Developers Need to Track The Ninth Circuit was deliberate in narrowing its ruling to Comet as currently deployed. Specifically, the court acknowledged that different outcomes may apply when “the agent operates with greater autonomy or has more direct communication” with third-party servers. Today’s agentic apps often do operate at explicit user direction — per action, per session. However, the industry is clearly moving toward agents that run overnight, chain multi-step workflows, and execute without constant human input. The “user directed it” defense weakens precisely as agents become more capable. Therefore, developers building toward more autonomous systems should document agent architecture now: where instructions originate, which systems initiate network requests, and how much independent control the agent exercises at each step. That documentation may prove to be evidence in a future case. The ruling’s protection is real — don’t assume it scales automatically with your product’s autonomy. ## Key Takeaways - The Ninth Circuit ruled AI agents acting through a user’s browser are the user’s tool — the user, not the AI company, “accesses” the target site under CFAA - Architecture is decisive: agents that route all requests through the user’s device benefit from this ruling; agents that directly contact third-party servers from your own infrastructure do not - CFAA protection doesn’t cover Terms of Service violations, trademark claims, or direct-server-access scenarios — for most developers, the real legal exposure is ToS, not CFAA - As agents become more autonomous, the “user directed it” defense weakens — document your agent’s architecture precisely now - Platforms will respond with tighter ToS and technical countermeasures; this ruling shifted the battlefield, not the war