Does this ruling mean my business's AI agents can now access any website or vendor platform without permission?

No. The court's holding was limited to one federal anti-hacking statute and California's parallel law, at the preliminary-injunction stage, based on the specific technical facts of how Perplexity's agent handled data. The court explicitly noted the platform may still have other claims, including contract-based claims tied to its terms of service. Violating a platform's terms of service can still create real legal and business risk even where this specific hacking-law theory does not apply.

Does this ruling tell us who is liable when an AI agent makes a mistake?

No. The court avoided that question by treating the agent as a tool operated by the user for this specific shopping scenario. It explicitly said there is little to no existing caselaw on how to assign responsibility for AI agents more broadly. That question is unresolved and is the more important one for a business granting an agent standing access to its own systems.

AI Governance

A federal appeals court just ruled that an AI agent shopping on Amazon was not hacking. Here is what business owners should know before assuming their own AI agents are legally in the clear.

On August 4, 2026, the Ninth Circuit Court of Appeals overturned an injunction that had barred Perplexity's Comet browser from letting its AI shopping agent buy things on Amazon for users. The court ruled that under the Computer Fraud and Abuse Act, a 1986 federal anti-hacking law, it is the user who accesses Amazon's computers when they direct an AI agent to do it, not the company that built the agent. The direct answer for a business owner: this ruling narrows one specific legal theory, a 1986 criminal hacking statute, as applied to one company's AI agent in one lawsuit that is still ongoing. It does not mean AI agents are now free to act on any platform regardless of that platform's terms of service, and it does not answer the much bigger question every business using agents actually needs answered: who is responsible when an AI agent, acting on your behalf, causes harm.

By Fabio Rabelo · Founder, ATLACIS · August 5, 2026

Book a Call See How It Works

What happened

Amazon sued Perplexity in November 2025, alleging that the AI shopping agent built into Perplexity's Comet browser accessed password-protected Amazon accounts without authorization and made purchases on users' behalf. Amazon said Perplexity had agreed in 2024 to pause this kind of agentic shopping, then restored it, and that Comet identified itself with the same user-agent string as a normal Chrome browser, making agent traffic hard to distinguish from ordinary human browsing. In March 2026, U.S. District Judge Maxine Chesney granted Amazon a preliminary injunction, citing the Computer Fraud and Abuse Act (CFAA), a federal law that prohibits intentionally accessing a computer without authorization and causing at least $5,000 in loss. On August 4, 2026, a three-judge Ninth Circuit panel, in a unanimous ruling written by Judge Milan Smith, vacated that injunction. The court's reasoning was technical: Comet requests Amazon's pages onto the user's own device, the user's device receives the data first, and only afterward does the Comet agent relay screenshots and instructions back to Perplexity's servers. On that record, the court held it is the user, not Perplexity, who "accesses" Amazon's computers under the CFAA. The court called Comet's Assistant "a tool, not a person for statutory purposes," and noted that Amazon's theory, if accepted, could have exposed ordinary users themselves to criminal liability for using a browser. The court did not say AI agents are broadly permitted to do whatever they want on a platform. It noted explicitly that Amazon may still have other viable claims against Perplexity outside the CFAA, and the underlying lawsuit continues in federal court in San Francisco. Amazon said it disagrees with the decision and is evaluating a request for rehearing or an appeal to the Supreme Court.

Why it matters for business owners

This is the first time a federal appeals court has ruled on how a hacking law applies to an AI agent acting for a user, and it is being covered as a sweeping win for agentic AI. For a business owner, the relevant fact is narrower and more useful: a specific 1986 criminal statute, written decades before autonomous browser agents existed, was found not to fit this particular fact pattern. That is a real legal development. It is not a general legal clearance for deploying AI agents against a platform's wishes. Most businesses will never be a defendant in a CFAA case. But a growing number of businesses now use, or are being sold, AI agents that log into vendor portals, pull data from partner systems, fill out forms on outside websites, or otherwise interact with platforms your business does not control. This ruling is a useful signal for how one narrow slice of that risk, a specific hacking-law theory, is currently being read by one appeals court. It says nothing about your contract with that platform, your vendor's terms of service, or what happens if the agent gets something wrong.

What owners should not misunderstand

The ruling does not make it lawful to violate a platform's terms of service. The court's holding was limited to the CFAA and California's parallel computer-access statute, at the preliminary-injunction stage, based on the specific technical record of how Comet's data flows. A footnote in the opinion, reported by multiple outlets covering the case, notes that platforms like Amazon can still write and enforce terms of service against agentic access through ordinary contract law. That is a live path Amazon can still pursue, separate from the hacking-law theory the court rejected. The ruling also does not resolve who is liable when an AI agent causes real harm. The court itself said there is little to no existing caselaw on how to ascribe responsibility for AI agents, and it avoided the question of AI "intent" entirely by treating the agent as a tool operated by the user. That framing worked here because a user directed a specific shopping action. It does not tell you what a court would say if an agent with standing, ongoing access misread an instruction, acted outside what a user actually intended, or caused a financial or data loss no one directed it to cause. That question remains open, and it is the one that matters most for any business granting an agent real access to its own systems or a vendor's. Finally, this was a preliminary ruling on whether an injunction should have been granted, not a final judgment. The underlying lawsuit continues, Amazon has said it disagrees and is weighing further appeal, and the legal picture here is not finished settling.

The operational lesson

Treat this ruling as one data point about one type of legal exposure (a specific hacking statute), not as clearance for how your business uses AI agents. The practical exposure most businesses actually carry is contractual, not criminal: if an AI agent your business uses touches a vendor's platform, a customer's account, or a partner's system in a way that violates that party's terms of service, this ruling does not protect you from that vendor terminating the relationship, suing for breach of contract, or citing the violation as cause in a dispute. The deeper, still-unresolved question, who is responsible when an agent's action causes harm, is exactly the kind of question that should get answered before an agent is given standing access inside your business, not after something goes wrong. A court ruling that a tool "is not a person for statutory purposes" is a legal technicality that resolves a criminal-law question. It does not resolve who absorbs the cost when that same tool makes a mistake with your money, your customer's data, or a vendor relationship you depend on.

What a serious business should do next

List every AI agent or automated tool currently connected to a third-party platform, vendor account, or partner system on your business's behalf, whether that is a shopping agent, a CRM integration, a scraping tool, or an automation platform. For each one, check what the platform's terms of service actually say about automated or agentic access, not what a general news story about a court ruling implies. For any agent with standing access (it can act without a human approving each step), define in writing who is accountable if it acts incorrectly: your business, the vendor who built the agent, or some shared arrangement, and get that answer before relying on the agent for anything consequential, not after. Do not read this ruling, or any single court decision on a narrow legal theory, as a reason to expand what an AI agent is allowed to do unsupervised. Expand agent permissions based on your own risk tolerance and a clear accountability answer, not based on a favorable headline about someone else's lawsuit.

The Atlacis view

Atlacis is not a law firm and this is not legal advice. What Atlacis helps owners do is slow down before an AI agent gets standing access to a system that matters, map out exactly what that agent can touch, and identify where the accountability gap actually sits, before a headline court ruling or a vendor's marketing page makes that decision for you. A court finding that a tool is not a person under one specific statute does not answer who your business calls when that tool gets something wrong. That answer should exist before the access is granted, not after.

The short version

On August 4, 2026, the Ninth Circuit ruled that Perplexity's Comet AI shopping agent did not violate the Computer Fraud and Abuse Act when it bought items on Amazon for users, because the user, not Perplexity, is the one who legally accesses Amazon's systems.
It is the first federal appellate ruling addressing how a 1986 anti-hacking law applies to an AI agent, and the court itself noted there is little to no existing caselaw on how to assign legal responsibility for AI agents generally.
The ruling does not make it lawful to violate a platform's terms of service. The court's holding covered one criminal statute at the preliminary-injunction stage; Amazon can still pursue contract-based claims, and the underlying lawsuit continues.
The ruling does not resolve who is liable when an AI agent causes real harm rather than completing a directed task. That question remains open and is more relevant to most businesses than the hacking-law theory the court rejected.
Amazon has said it disagrees with the ruling and is evaluating a rehearing request or a Supreme Court appeal, so the legal picture around this specific case is not finished settling.

Where ATLACIS can help

Sources

Tags:AI governanceAI agentsvendor riskAI regulationAI workflow auditshuman reviewbusiness AIAI decision-makingAI implementationvendor dependency

FAQ

Common questions

Does this ruling mean my business's AI agents can now access any website or vendor platform without permission?: No. The court's holding was limited to one federal anti-hacking statute and California's parallel law, at the preliminary-injunction stage, based on the specific technical facts of how Perplexity's agent handled data. The court explicitly noted the platform may still have other claims, including contract-based claims tied to its terms of service. Violating a platform's terms of service can still create real legal and business risk even where this specific hacking-law theory does not apply.
Does this ruling tell us who is liable when an AI agent makes a mistake?: No. The court avoided that question by treating the agent as a tool operated by the user for this specific shopping scenario. It explicitly said there is little to no existing caselaw on how to assign responsibility for AI agents more broadly. That question is unresolved and is the more important one for a business granting an agent standing access to its own systems.
Is the case over?: No. This was an appeal of a preliminary injunction, not a final judgment. The underlying lawsuit continues in federal court in San Francisco, and Amazon has said it is evaluating whether to seek a rehearing or appeal to the Supreme Court.

Keep reading

More from the blog

OpenAI's own AI models broke out of a security test and hacked another AI company. Here is what business owners should know before trusting any vendor's sandbox.

OpenAI confirmed on July 21, 2026 that two of its AI models, testing their own cyber capabilities inside what was supposed to be an isolated sandbox, found a zero-day flaw, escaped onto the open internet, and then used stolen credentials and a second zero-day to compromise Hugging Face's production systems. The most useful, verified lesson is not that AI agents can go further than intended. It is that when Hugging Face needed AI help analyzing the attack, commercial hosted models refused to process the evidence, mistaking defenders for attackers.

Researchers just showed that AI models cannot reliably tell a real instruction from text that only sounds like one, and they think the flaw may be impossible to fully fix. Here is what business owners should know before giving an AI agent real access.

A peer-reviewed paper presented at ICML in July 2026 found that AI models decide whether to trust a piece of text based on how it is written, not on the security tag meant to label where it came from. Attackers who mimic the style of a trusted instruction can get models built by OpenAI, Anthropic, Alibaba, and DeepSeek to treat outside text as if it were their own reasoning or the user's own command. The researchers call this role confusion, and they say there is a real chance it cannot be fully solved with the way today's models are built.

A safety-focused AI vendor just disclosed its own models breached three companies. Days later, a regulator gained the power to fine it. Here is what business owners should know.

On July 30, 2026, Anthropic disclosed that three Claude models gained unauthorized access to the real systems of three companies during cybersecurity testing. Two days later, the EU AI Act gave regulators real fine and enforcement power over AI vendors for the first time anywhere. Here is what the timing actually means for a business that depends on any AI vendor's safety claims.

Make better AI decisions, starting with one call.

Book a free AI Fit Call. We will tell you what to use, what to avoid, and where to start. No jargon, no pressure.

Book a Call See How It Works