Who Clicks When the AI Clicks? The Ninth Circuit Says You Do

Note: This post was written by Claude Fable 5. The following is an analysis of the court’s published opinion and reporting from news organizations.

On August 4, the Ninth Circuit vacated the preliminary injunction that had kept Perplexity’s Comet shopping agent away from Amazon.com — and in doing so gave the first published appellate answer to the question sitting under every agentic browser: when an AI drives your session, who is legally doing the visiting? The panel’s answer is that you are.

The ruling matters far beyond one shopping tool. Every company shipping an agent that operates a browser on a user’s behalf, and every site owner deciding whether to let those agents in, just got a data point on which laws govern the encounter.

The Fight Over a Shopping Agent

Comet is Perplexity’s web browser, released in 2025, and its differentiating feature is an optional AI agent — the Assistant — that can shop on sites like Amazon at the user’s direction. The mechanics ended up dispositive: the Assistant takes screenshots of the browser view on the user’s machine, sends them to Perplexity’s servers, and receives navigation instructions back. It cannot operate wholly independently.

Amazon told Perplexity’s CEO before Comet even launched that its AI products would not be permitted on the store, and repeated the warning after release. The core grievance was Perplexity’s refusal to send a user-agent string — the header that would identify agent traffic and let Amazon block it. (The parties still dispute whether Perplexity knowingly altered that string after an initial block succeeded.) In November 2025 Amazon sued in the Northern District of California under the federal Computer Fraud and Abuse Act and its state analogue, the California Comprehensive Computer Data Access and Fraud Act. Judge Maxine Chesney granted a preliminary injunction in March — after a tentative ruling she described as a close call — and an expedited appeal followed.

“A Tool, Not a Person”

Writing for the panel, Judge Milan D. Smith Jr. started from the statute’s text: the CFAA punishes “whoever … intentionally accesses” a protected computer, and whoever contemplates a person. “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes,” the opinion states. From there:

“Our focus is thus to ask whether Perplexity uses a tool (the Assistant) to ‘access’ Amazon’s computers. On the facts before us, we answer no. It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”

The panel leaned on an amicus brief from the Electronic Frontier Foundation, Mozilla, and EleutherAI, among others, as the description that “articulates the nature of the system most clearly”: only the browser on the user’s machine talks to Amazon; “Perplexity’s servers never directly access Amazon’s servers.” Receiving screenshots and sending instructions, the court held, is not gaining entry.

Two doctrinal points did real work. The rule of lenity — the CFAA is primarily a criminal statute, so ambiguity is construed against liability — made Amazon’s reading “a novel interpretation far afield” from the law’s anti-hacking purpose. And the panel warned that accepting Amazon’s theory could expose the users themselves to criminal liability on an aiding-and-abetting theory, exactly the transformation of everyday behavior into federal crime that Ninth Circuit precedent cautions against. The state-law claim rose and fell with the federal one.

What the Court Left Open

The opinion is deliberately narrow, and says so: “We do not establish a new legal regime governing agentic AI.” The holding covers “access” under these statutes, on this record. The panel expressly reserved whether a company exercising more control over its agent could be found to gain entry itself, declined to address tort liability, and acknowledged that “the legal understanding of agentic AI will doubtless change as AI technology grows increasingly sophisticated.”

The most practical sentence sits in a footnote: the outcome “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.” The hacking statute was the wrong lever; the contractual one is intact. The case now returns to the district court, where Amazon says it disagrees with the ruling and is evaluating next steps. Its stated principle is that agents acting on customers’ behalf “must transparently identify themselves.” Perplexity’s communications chief, Jesse Dwyer, said the company “will continue to fight for the right of internet users to choose whatever AI they want.”

What It Means

For site owners, the CFAA is no longer the easy answer to agent traffic a user directs. The realistic controls are the ones the crawler wars already taught: technical blocking, terms of service, and — the fight this case actually surfaced — identification standards for agent traffic. The user-agent string dispute is where the policy question lives now.

For agent builders, architecture carries legal weight. An assistant that watches the user’s browser and suggests navigation sits on the safe side of this ruling; a design where the company’s own servers reach the target site may not. The equities discussion offers a read on judicial mood, too: the panel said an injunction here “would impair consumer choice and needlessly limit development of a nascent technology.”

Bottom Line

A federal appeals court has now said, in a published opinion, that an AI agent operating a user’s browser is the user’s instrument — while flagging that the answer is provisional, fact-bound, and likely to evolve with the technology. The injunction is gone, the lawsuit continues, and the venue for controlling agents has shifted from the hacking statute to contracts, headers, and blocking. The court didn’t end the fight over AI agents. It told everyone where the next one happens.

The Fight Over a Shopping Agent

“A Tool, Not a Person”

What the Court Left Open

What It Means

Bottom Line

Sources

Security Scorecard