Amazon v. Perplexity: Who “Accesses” a Website When an AI Agent Acts?

The Ninth Circuit recently ruled that when your AI agent accesses a third-party website on your behalf, you're the one doing the accessing under the CFAA -- not the agent. This is the first federal appellate ruling on AI agent attribution.

Perplexity’s "Comet" browser and its "Assistant" agent were interacting with the Amazon Store despite Amazon’s demands to stop. Amazon sued Perplexity under the federal Computer Fraud and Abuse Act (CFAA) and California’s analogous Comprehensive Computer Data Access and Fraud Act (CDAFA) and won a preliminary injunction in district court.

The Ninth Circuit vacated the injunction. The panel observed that the CFAA applies to "[w]hoever . . . intentionally accesses" a protected computer — language contemplating a person, whereas the Assistant is "a tool, not a person". Because Perplexity’s servers never directly communicate with Amazon’s servers (the user’s local browser does), the user accesses Amazon with the help of the Assistant. The court also invoked the rule of lenity, warning that adopting Amazon’s expansive theory could improperly expose everyday users to criminal conspiracy or aiding-and-abetting liability. Amazon's CDAFA claims failed for the same reasons.

This does not mean agentic AI is immune from the CFAA. The panel reserved judgment on whether a different record could show Perplexity exercising control over the Assistant in a way that "gain[s] entry" to remote servers. The court also noted that platforms remain free to regulate access through private terms of service with their users — just not through expansive readings of criminal anti-hacking statutes.

Businesses deploying AI agents must understand how those tools access third-party systems and who controls their actions. Before deployment, review the agent’s technical operation, applicable website terms, and contractual restrictions. Similarly, businesses operating online platforms should reassess their access terms and technical controls rather than assume the CFAA will resolve every dispute involving AI agents.

For more on artificial intelligence and cybersecurity, click here or here.