Who accesses a website when an AI agent browses it?

The Ninth Circuit vacated a preliminary injunction Amazon had won against Perplexity AI over its Comet browser's shopping agent, the "Assistant," which "can perform tasks at the user's direction, such as browsing websites like Amazon.com to shop for requested goods." The panel held Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) claim because Perplexity itself never "accessed" Amazon's computers: "it was the user who 'accessed' Amazon's computers, with the help of Perplexity's AI agent." The CFAA's private right of action requires showing a defendant intentionally accessed a computer, without authorization or exceeding authorized access, and obtained information from it, but the panel read the statute's "[w]hoever... accesses" language as contemplating access "by a person" — and found that "however advanced the Assistant currently is, it is a tool, not a person for statutory purposes." The same reasoning sank Amazon's parallel state-law claim under California's CDAFA, and the panel also held the remaining equitable factors (harm, balance of hardships, public interest) favored Perplexity, not Amazon, once the CFAA claim was unlikely to succeed.

The mechanism the court gives is architectural: when the Assistant acts, it "takes screenshots of the browser view, sends those screenshots from the user's computer to Perplexity's servers, and receives instructions from Perplexity's servers on how to navigate Amazon.com." Quoting an amicus brief (EFF, Mozilla, and others), the opinion stresses that "Perplexity's servers never directly access Amazon's servers" — the browser on the user's own machine is what communicates with Amazon, and the Assistant only analyzes what the browser already displayed. Amazon countered that the Assistant "behaves like an efficient human shopper" and proceeds autonomously enough that its actions should be ascribed to Perplexity, as in Facebook v. Power Ventures, where automated conduct directed by a third party's servers was held attributable to that third party. The panel found Power Ventures and the cited precedents an imperfect fit, calling agentic AI "an emerging technology" with "little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents."

This cuts the opposite way from Can a company escape chatbot liability by calling it separate?. There, the company that deployed the chatbot on its own site bore the liability for what it said. Here, Perplexity built the Assistant but the user is the one who deploys it against a third party's site (Amazon), and the court treats the agent as the user's tool, "a tool, not a person," — leaving the AI company that wrote and operates the tool outside the liability frame entirely. Read together, the two cases suggest the same tool-attribution logic can point at either the platform or the end user depending on who is said to be directing the agent in a given transaction, which is exactly the prior question Can traditional governance tools actually control AI agents? identifies as unresolved once an agent is granted discretion: what obligations and liabilities attach to whom, independent of how autonomous the agent appears.

The opinion decides a narrow legal question — whether Amazon showed a likelihood of success on a preliminary-injunction standard — not the ultimate merits, and the case was remanded rather than resolved. It also turns on the specific architecture the record showed (screenshots and instructions relayed through the user's own browser session, no direct server-to-server contact, and Perplexity's prior refusal to send a "user-agent string" identifying the agent to Amazon); the court does not say how it would rule if an agent's servers communicated with a target site directly, or how much autonomy an agent could have before its actions stopped being attributable to the user who invoked it. The panel's own acknowledgment that agentic AI is "emerging" with no settled caselaw implies this allocation of responsibility to the user rather than the AI vendor is provisional, not a general rule for agentic commerce — the next case with different architecture or more site-blocking countermeasures could come out differently.