A U.S. appeals court has given builders of practical AI agents a decision they will quote for years, even if the case is far from over. On August 4, 2026, the Ninth Circuit vacated a preliminary injunction that had blocked Perplexity’s Comet shopping assistant from operating on Amazon. The narrow legal holding was about the Computer Fraud and Abuse Act and California’s similar computer-access statute. The practical signal is broader: when a person directs an AI browser assistant to use a website the person can already visit, the assistant may look less like a hacker and more like the user’s chosen tool.

User-directed AI assistant operating a shopping site under platform and legal constraints

What actually changed

Amazon sued Perplexity in November 2025 and won a March 2026 preliminary injunction in the Northern District of California. The fight centered on Comet, Perplexity’s AI-enabled browser, and its Assistant feature. The court record describes Comet as a browser running locally on the user’s machine. When a user asks the Assistant to find an item on Amazon, the browser view is captured, screenshots are sent from the user’s computer to Perplexity’s servers, and instructions are returned about how to navigate the page. Amazon argued that this was unauthorized access to its systems; Perplexity argued that the user, not Perplexity, was accessing Amazon with help from software.

The Ninth Circuit accepted Perplexity’s argument at the preliminary-injunction stage. The panel said Amazon was unlikely to prove that Perplexity itself had ‘accessed’ Amazon computers for CFAA purposes. The opinion’s core sentence is unusually important for agent builders: on the facts before the court, ‘it is the user who “accesses” Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.’ The court reached the same result under California’s CDAFA, vacated the injunction and sent the case back for further proceedings.

That is not a final victory on every claim. It is not a global license for bots to ignore website rules. It is not legal advice for startups. The opinion repeatedly narrows itself: it deals with the access element of CFAA and CDAFA, on the current record, at the preliminary-injunction stage. The underlying lawsuit continues, and Amazon can still press private terms of service, product-safety, contract, consumer-protection, privacy or other theories where the facts support them. But the decision weakens one sharp argument platforms have used against third-party agents: that a user-directed agent is automatically an unauthorized computer intruder.

Why this matters beyond shopping

Shopping is only the most visible version of a much larger design problem. Useful AI agents do not become useful by sitting inside a chat window; they become useful when they can read pages, fill forms, compare options, move data between services, ask for confirmation and complete boring tasks. That covers online retail, travel booking, expense reports, procurement, customer support consoles, SaaS administration, CRM updates, invoice workflows and internal web tools that still have no clean API. For those use cases, the web page is often the real interface of work.

Platforms see the same future from the opposite side. A retailer, marketplace, airline, publisher or SaaS provider designs its interface to manage ranking, advertising, recommendations, fraud controls, customer experience, rate limits, analytics and support. A third-party agent can bypass sponsored placements, ignore cross-sell modules, scrape comparison data, trigger security systems, make wrong selections or create traffic that is hard to bill and hard to attribute. Amazon’s objections were not only about advertising. The record and March coverage also described concerns about customer accounts, automated traffic, stored payment and delivery information, and whether an outside assistant should be allowed to act inside a password-protected account.

That tension is why the decision belongs in an AI practice column rather than a legal footnote. Product teams building browser agents now have a more credible path for user-directed access, but also a clearer responsibility to design agents as accountable tools rather than stealth automation. Platform teams have a reason to build official agent paths instead of relying only on blunt blocking. Enterprise adopters have a reminder that browser automation is not just an engineering convenience; it is a legal, security and governance decision.

The court’s logic in plain English

The CFAA was written as an anti-hacking statute. The Supreme Court and the Ninth Circuit have been cautious about turning ordinary computer use into federal crime merely because a computer is involved. In this case, the panel focused on who entered Amazon’s computer system. Perplexity’s servers did not directly request pages from Amazon. The user’s browser requested the page, displayed it to the user, and the Assistant analyzed what the browser had displayed. Perplexity’s servers could receive screenshots and send instructions back, but the panel said that did not, by itself, mean Perplexity had gained entry to Amazon’s servers.

The opinion also treated the Assistant as a tool rather than a legal person. The CFAA punishes whoever intentionally accesses a protected computer. However advanced the Assistant is, the court said, it is a tool, not a person for statutory purposes. That distinction matters because many policy debates casually describe agents as actors. Courts may still attribute an agent’s conduct to a company in other contexts, and the opinion explicitly refuses to decide tort liability or the broader legal regime for agentic AI. But for the access element of this anti-hacking claim, the panel looked at the human user and the browser architecture.

The public-interest discussion is equally practical. The court said an injunction against conduct that likely does not violate CFAA or CDAFA would impair consumer choice and needlessly limit development of a nascent technology. That sentence will be attractive to AI companies and digital-rights groups. Yet footnote language also matters: the result does not impair Amazon’s ability to regulate access through private terms of service for its users. In other words, the court pushed back against hacking-law overreach without declaring that platforms have no control.

What builders should take from it

The safest lesson is not ‘ship the bot and let lawyers worry later.’ The safer lesson is architectural: make the user’s direction visible, specific and logged. A browser agent that acts only after a user asks for a defined task is easier to defend than an agent that silently roams, clicks and purchases. Keep approval gates for checkout, account changes, subscriptions, cancellations, returns, messages and anything involving money or legal commitment. A user should know when the agent is merely reading, when it is filling a form and when it is about to bind the user to a transaction.

Identity should also be explicit. The disputed user-agent issue did not disappear just because Amazon lost the injunction. If a platform believes an agent is disguising itself as an ordinary browser to avoid detection, the fight moves from CFAA to trust, contracts, anti-fraud systems and commercial retaliation. Product teams should decide how their agents identify themselves, how much control users have over that identity, and what happens when a site blocks agent traffic. Silent evasion may win a short-term demo and lose the long-term market.

Data minimization is now a product feature. In Comet’s described architecture, screenshots of the user’s browser view can leave the device so that remote servers can decide the next action. That may be technically reasonable, but it raises privacy questions: what is captured, which account data is visible, how long screenshots or derived traces are kept, whether payment and address fields are masked, and whether enterprise customers can force local processing or stricter retention. An AI agent that reads a procurement portal or HR system needs a data-handling design before it needs a flashy demo.

What companies using agents should ask

An enterprise should not treat this ruling as permission to let employees point autonomous browsers at every internal and external service. The first question is authority: who asked the agent to act, for what purpose, under which account and spending limit? The second is evidence: what logs show the user instruction, intermediate decisions, approvals, errors and final action? The third is site policy: does the target service allow automation, require an API, prohibit credential sharing or ban non-human traffic? The fourth is containment: can the agent operate in a sandboxed profile with scoped credentials instead of a full employee browser?

For procurement, travel and SaaS administration, the operational checklist is concrete. Require confirmation before purchases and cancellations. Use separate payment instruments where possible. Restrict the agent to approved vendors. Rate-limit actions. Store auditable traces without keeping unnecessary page screenshots forever. Red-team prompt injection from product pages, messages and hidden instructions. Define who pays when the agent books the wrong flight, orders the wrong item or changes a setting in the wrong tenant. The legal ruling may make one category of claim less frightening, but it does not make bad automation safe.

What platforms should do next

Platforms also have choices. Blocking every third-party agent as a bot may become harder to justify when users clearly delegate actions. But doing nothing is not realistic. Retailers and SaaS companies can build official agent APIs, delegated-auth flows, scoped tokens, agent-readable policies, checkout confirmation protocols and audit channels. They can distinguish a user’s assistant buying one item from a scraper harvesting catalog data at scale. They can expose safe comparison data without handing over payment flows. The companies that design for accountable delegation may keep more control than those that only fight at the perimeter.

Retail media is the business pressure point. If agents compare products by price, delivery, return policy and user preference, sponsored ranking and recommendation funnels become less powerful. Advertisers buy human attention; agents may ignore banners, upsells and persuasion. That does not mean retail advertising dies, but it changes where persuasion happens. Platforms may try to influence the agent layer through feeds, structured claims, reputation signals, first-party assistants and paid placement in agent-readable results. Regulators and customers will then ask whether the agent serves the user or the platform’s ad inventory.

Security is still the hard part

Browser agents are exposed to prompt injection in a way ordinary scripts are not. A product page, review, email, support chat or hidden webpage text can try to tell the agent to ignore the user, leak data, select a worse product or change a delivery address. A shopping agent also touches payments, addresses, returns and account trust. Even if the law treats the agent as the user’s tool, the user will not accept ‘the tool clicked it’ as an answer when money is lost. Practical deployments need content isolation, instruction hierarchy, transaction confirmations, sensitive-field masking, rollback paths and fraud monitoring.

The Ninth Circuit noted that Amazon’s cyber-risk evidence was limited on the record before it. That should not be misread as a finding that agentic browsing is safe. It means Amazon did not prove enough for this injunction. Security teams should assume agents will be attacked through the pages they read. They should test malicious listings, hidden text, misleading buttons, fake login prompts, poisoned comparison tables, refund abuse and account-takeover scenarios before expanding permissions.

The real boundary: tool, not stealth operator

The strongest version of agentic web automation is user agency: people should be able to bring tools that help them understand, compare and act on services they are allowed to use. The weakest version is stealth operation: a company’s servers direct actions in someone’s account while hiding the agent’s identity, collecting excessive data and treating platform rules as an obstacle to bypass. The court’s opinion helps the first story. It does not protect every version of the second.

For AI startups, the winning design language should be boring and accountable: explicit user instruction, clear consent, least-privilege credentials, transparent identity, logs, confirmation gates, data minimization, platform-aware fallbacks and a plan for refusal when a site disallows automation. For businesses adopting agents, the ruling is a reason to pilot carefully, not a reason to skip legal and security review. For platforms, it is a warning that user choice is becoming part of the legal and product debate around the web.

Bottom line

The Perplexity-Amazon decision did not legalize all AI bots, and it did not decide the future of agentic commerce. It did something narrower and more useful: it made it harder to equate a genuinely user-directed browser assistant with hacking under the CFAA on the facts presented. That is enough to shift the practical conversation. The next generation of agents will be judged less by whether they can click through a website and more by whether they can prove whose instruction they follow, what data they touch, how they identify themselves and how they stop before doing harm.