Perplexity Comet Ruling: Ninth Circuit Lifts Amazon's AI Agent Ban

A first appellate answer on AI agents

The first federal appeals court to rule on AI shopping agents has decided that, under anti-hacking law, the person who sends an agent to a website is the one who "accesses" it. The company that built the agent is not. On August 4, 2026, the Ninth Circuit Court of Appeals vacated a preliminary injunction that had kept the Assistant in Perplexity's Comet browser out of Amazon shopping accounts. The court found Amazon unlikely to win its claims under the federal Computer Fraud and Abuse Act (CFAA) or California's Comprehensive Computer Data Access and Fraud Act (CDAFA).1117 Reuters described it as the first federal appellate ruling on whether AI agents acting for users can legally access online platforms.13

Comet's Assistant can sign in to a user's Amazon account with stored credentials, compare products and place orders.5 Judge Milan D. Smith Jr. wrote the unanimous 21-page opinion for a three-judge panel.58 The panel described the Assistant as "a tool, not a person" for the purposes of the statute.12

The case now goes back to the Northern District of California. Comet can keep shopping on Amazon while the lawsuit continues.417

How the dispute got here

The basic timeline is clear, though some coverage gets the dates wrong. Amazon filed suit in the Northern District of California on November 4, 2025, under case number 3:25-cv-09514.515 Engadget and at least one other outlet said the suit was filed in March 2026.107 That appears to confuse the filing with the injunction. Judge Maxine Chesney granted the injunction on March 9, 2026.5

Amazon's case rested on a claim of bad faith. It said the two companies had agreed in November 2024 to pause agentic shopping on Amazon. It accused Perplexity of turning the feature back on when Comet launched and of making the Assistant's traffic look like an ordinary Chrome session so it would be hard to detect.25 Legal analyses of the record say Comet did not use a unique "user-agent string" to identify itself, so Amazon could not tell when the Assistant was operating.12 Perplexity disputed parts of this account.2 It said Comet acts only with the user's permission, using credentials stored on the user's own device, and that Amazon was trying to limit consumer choice in AI assistants.1

Judge Chesney sided with Amazon at first. She found "strong evidence" that Comet entered password-protected accounts with the user's permission but without Amazon's authorization, and sent account information to Perplexity's servers.12 Her order kept Perplexity's agent away from Amazon account pages, including Prime accounts. It also required Perplexity to destroy Amazon data it had collected, including copies held by its service providers.615 Perplexity appealed almost immediately. The Ninth Circuit issued an administrative stay in April, followed by a fuller stay pending appeal, so the shopping feature kept running throughout the appeal.5 The court heard oral argument in Seattle on June 11.2

Architecture decided the case

The ruling depends heavily on how Comet is built, which is unusual for a legal decision. According to the court, the Assistant runs on the user's own device. It takes screenshots locally, sends them to Perplexity, and receives instructions back. Perplexity's servers never connect directly to Amazon's.11 The panel separated this setup from cases involving direct server-to-server traffic and treated the Assistant as closer to a browsing tool than to an intrusion.11

The panel did not treat the missing direct connection as the end of the question. It still asked whether Perplexity reached Amazon through the Assistant. It concluded that receiving screenshots and sending back instructions does not amount to Perplexity gaining entry to Amazon's servers.1213 The court said the CFAA's wording suggests the Assistant itself cannot "access" anything, which leaves the user as the party doing the accessing.14

Both sides framed the question with analogies. Perplexity told the court that a Comet user visiting Amazon is no more Perplexity than a Safari user is Apple.8 Amazon compared Perplexity to an arsonist who blames the mail carrier for delivering the bomb.8 The panel accepted the browser comparison. It said holding Perplexity liable would require a novel reading of the statute far from its anti-hacking purpose.8

One outlet reported that Perplexity's engineers deliberately kept Comet inside the browser session because of concerns about unauthorized access.9 No other report supports that claim, so it should be treated with caution. Either way, the effect is clear: a design decision about where the agent runs largely determined who was legally exposed. Product teams elsewhere will take note.19

The court went beyond the merits

Much of the coverage focuses on the access question. But the panel also reversed the district court on every other injunction factor. It found Amazon's evidence of irreparable harm weak and abstract, and noted that Amazon's own expert could not fully reproduce the cybersecurity risks Amazon described.1513 It concluded that the balance of hardships and the public interest favored Perplexity. Judge Smith wrote that an injunction "would impair consumer choice and needlessly limit development of a nascent technology."817

That language matters for Perplexity. Courts at this stage rarely speak of protecting emerging technology so directly. The opinion also considered that ruling for Amazon could have left users themselves open to criminal liability for sending agents into their own accounts. Wilson Sonsini's analysis highlighted this point.15

How narrow is the precedent?

This is where the coverage diverges most. Some outlets presented the decision as a broad legal green light. One said it opened a "legal corridor" for agentic commerce and gave Perplexity an opinion saying users can authorize agents on any site they visit.9 Another headlined that courts had ruled AI shopping agents "legal."2

The opinion does not support that reading. The panel said explicitly that it was not creating "a new legal regime governing agentic AI." It also left open whether Perplexity could be liable under other theories, such as tort, and did not limit Amazon's ability to control access through its terms of service.11 It acknowledged that on a different record, Perplexity might control the Assistant in a way that does amount to entering Amazon's servers.12 The court left the user-agent string dispute unresolved and did not consider a separate CFAA fraud provision that Amazon had not argued on appeal.15 The ruling is a preliminary-injunction decision about likely success, not a final judgment on liability.15

The fairest reading is that this is a narrow holding with large practical effects. Legally, it covers one architecture on one record. Practically, it removes the CFAA as the easy tool platforms might have used to block AI agents they did not approve. Law firm commentary largely agrees that disputes will move toward contract law and terms-of-service enforcement.1315

Why it matters for AI agents

The stakes reach well beyond Perplexity. The ruling arrives as companies including PayPal, Google, Apple and OpenAI build agents that can make purchases.9 Cloudflare data reported in September put bots and AI agents above half of all web requests.16 Digital-rights groups and Mozilla filed briefs supporting Perplexity, and news organizations filed in support of Amazon.8 The Electronic Frontier Foundation's Andrew Crocker said the ruling stops the CFAA from turning browser makers into hackers.15

The commercial motive behind the case is also clear. Amazon has its own shopping assistant, Rufus. A third-party agent that sits between shoppers and Amazon's storefront threatens Amazon's position as the place where shopping starts. One outlet argued the dispute is more about competition than hacking.9 Another pointed to Amazon's $19.8 billion in quarterly advertising revenue, which depends on human shoppers seeing Amazon's pages.2 These are analysts' readings rather than findings by the court, but they explain why Amazon pursued the case so hard.

The ruling also raises a less obvious issue. If the user is the legal actor, evidence about what an agent did may be split across the user's device, the user's account and an outside AI provider's systems. That makes preserving records more complicated in future litigation.15

What happens next

Amazon said it "respectfully" disagrees with the decision and is weighing its options.10 It could ask for rehearing by a larger Ninth Circuit panel or petition the Supreme Court, though neither route would restore the injunction quickly.910 Its CFAA and CDAFA claims are still pending in the district court.15

One litigation tracker predicts a negotiated settlement is the most likely outcome, probably between late 2027 and mid-2028. Under that scenario, Perplexity would identify Comet's agent traffic and Amazon would drop its claims.5 That is a forecast, not reported fact, but it is a reasonable one. Amazon has lost its main source of leverage. Perplexity, meanwhile, has an appellate opinion that calls its product a tool in the user's hands, and every company building AI agents can now cite it.