When an autonomous AI agent accesses a password-protected website, who actually does the accessing? According to the federal Ninth Circuit Court of Appeals, the person who directed the agent to access the site is the one responsible, not the company that developed the agent and certainly not the agent itself.
In a case involving Perplexity and Amazon.com, a three-judge panel of the appeals court vacated a lower court’s grant of a preliminary injunction barring Perplexity from accessing password-protected Amazon accounts. In a 21-page opinion last month, the panel ruled Amazon was not entitled to the injunction because it was unlikely to succeed on its claim under the Computer Fraud and Abuse Act (CFAA) that Perplexity was accessing the accounts without authorization.
The case concerned Perplexity’s Comet browser and its artificial intelligence (AI) agent, Assistant, that can carry out tasks such as searching Amazon’s website at the direction of a user. Prior to Perplexity’s launch of Comet in 2025, Amazon told Perplexity’s CEO that Perplexity’s AI products would not be permitted to access the Amazon Store. After the launch of Comet, Amazon reiterated to Perplexity that it did not have authority to access the store. When Comet users began using Assistant to scrape the Amazon Store Amazon sued Perplexity under the CFAA and its California analog, the Comprehensive Computer Data Access and Fraud Act (CDAFA).
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
In a ruling that holds potential implications for agentic commerce more broadly, however, the Ninth Circuit emphasized that plaintiffs cannot bootstrap the CFAA into a general-purpose law for policing unwanted online conduct.
“The Supreme Court has instructed that, ‘in the computing context, ‘access’ references the act of entering a computer system itself or a particular part of a computer system, such as files, folders, or databases,’” the Ninth Circuit’s opinion said. “Our focus is thus to ask whether Perplexity uses a tool (the Assistant) to ‘access’ Amazon’s computers. On the facts before us, we answer no. It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”
Another key holding by the court, according to an analysis of the ruling by attorneys with ZwillGen, is that AI agents are not persons in the eyes of the law. “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes,” the court wrote.
The court cautioned, however, that its ruling is narrow in scope.
“Because we recognize that agentic AI is an emerging technology, we reiterate what this opinion is not,” it wrote. “We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions. Our holding here is limited to ‘access’ as contemplated by the CFAA and as applied to the Assistant’s interactions with Amazon.com on the record before us, not the broader legal landscape surrounding agentic AI.”
The decision nevertheless offers an early indication that technical architecture may matter significantly for CFAA risk or companies developing agentic products, according to ZwillGen. “How much autonomy the agent possesses and how much control the developer exercises over its specific interactions with the third-party site may be a critical inquiry,” it wrote.
For website operators, the decision serves as another reminder that the CFAA is not necessarily a comprehensive remedy for unwanted access,” per ZwillGen. The Ninth Circuit expressly noted that its ruling does not prevent Amazon from regulating access through private terms of service or other means. “As we have seen throughout the evolution of web-scraping litigation, other claims (e.g., including contract, copyright, DMCA, and tort theories) may be effective,” it said.
Add as Preferred Source
