Amazon V Perplexity: The 9th Circuit Just Redefined Access – And Agentic AI Won

Introduction

The 9th U.S. Circuit Court of Appeals just handed down a landmark decision that fundamentally reshapes the legal landscape for agentic AI: a user’s AI assistant is not a hacker under the Computer Fraud and Abuse Act (CFAA). By overturning a preliminary injunction that had barred Perplexity AI’s Comet shopping agent from Amazon’s platform, the court established that when a customer delegates browsing and purchasing to an AI tool, it is the user—not the AI provider—who “accesses” the platform under federal law. This first-of-its-kind ruling carries profound implications for AI developers, e-commerce platforms, and the future of the transactional web.

Learning Objectives

Understand the legal distinction between user-directed AI access and provider-initiated access under the CFAA
Master the technical architecture of agentic browsers like Perplexity Comet and how they interact with target platforms
Identify practical bot detection, anti-scraping, and security controls that platforms can deploy in response to agentic AI
Develop actionable strategies for AI developers to design compliant agentic systems and for platforms to protect their infrastructure

You Should Know

The “Who’s at the Keyboard?” Problem: How the 9th Circuit Resolved Agentic AI Liability

The core legal question in Amazon.com Services, LLC v. Perplexity AI, Inc. was whether an AI agent’s actions can be attributed to its developer as unauthorized “access” under the CFAA—a federal anti-hacking statute enacted in 1986, long before the advent of agentic AI.

Amazon argued that Perplexity violated the CFAA by allowing its AI assistant to log into customer accounts, compare products, and place orders without Amazon’s authorization. The district court agreed in March 2026, granting a preliminary injunction.

The 9th Circuit reversed. Its reasoning turned on a textual interpretation: the CFAA punishes “whoever . . . intentionally accesses” a protected computer, and “whoever” means a person. The court held that Perplexity’s AI Assistant is “a tool, not a person for statutory purposes”. Critically, the court found that the user’s browser—not Perplexity’s servers—communicates directly with Amazon’s servers at all times. The Assistant takes screenshots of the user’s browser view, sends them to Perplexity’s servers for analysis, and receives navigation instructions in return—but the user’s device maintains the direct connection to Amazon.

What This Means for AI Developers:

User delegation is a legal shield. If your AI agent acts only at the explicit direction of the user and the user’s device maintains the direct connection to the target platform, you are unlikely to face CFAA liability for unauthorized access.
Server-side agents face greater risk. If your AI system connects directly from your infrastructure to third-party platforms—rather than routing through the user’s device—you may be deemed the “accessor” under the CFAA.
Terms of Service violations are not CFAA violations. The court noted that Amazon might have other viable claims against Perplexity, but invoking the CFAA was “legally baseless”.

2. Technical Deep-Dive: How Perplexity Comet Actually Works

To understand the ruling’s technical foundation, you must grasp Comet’s architecture. Perplexity Comet is a Chromium-based AI-first browser with an embedded agentic layer. Unlike a traditional browser extension, Comet’s agentic behavior is implemented natively within the browser’s renderer process via an internal extension that never appears in the public extensions UI.

Key Architectural Components:

| Component | Function |

|–|-|

| Comet Browser | Chromium-based browser with native AI integration |
| The “Assistant” | Agentic AI that monitors tabs, maintains cross-session context, and executes multi-step workflows |
| Perplexity Servers | Receive screenshots from the user’s browser, process them, and return navigation instructions |
| User’s Device | Maintains the direct HTTPS connection to Amazon’s servers; Perplexity’s servers never connect directly to Amazon |

Step-by-Step: How a Comet Shopping Transaction Executes

User Delegation: The user opens Comet and instructs the Assistant: “Find the best price for a Sony WH-1000XM5 on Amazon and buy it.”
Browser-Initiated Request: The user’s Comet browser sends a standard HTTPS request to Amazon.com—not Perplexity’s servers.
Screenshot Capture: The Assistant takes a screenshot of the user’s browser view (showing Amazon’s page) and sends it to Perplexity’s servers for analysis.
Server-Side Processing: Perplexity’s servers analyze the screenshot, parse the DOM structure, identify product listings, prices, and the “Add to Cart” button.
Navigation Instructions: Perplexity’s servers return instructions to the user’s browser—e.g., “Click the ‘Add to Cart’ button at coordinates (x,y)”.
User-Device Execution: The user’s browser executes these instructions, directly interacting with Amazon’s servers.
Transaction Completion: The Assistant navigates through checkout, using the user’s stored credentials and payment information, and completes the purchase.

Critical Security Implication: Comet’s network traffic appears indistinguishable from standard Chrome traffic to most detection systems. It uses Chromium-based user-agent strings with Perplexity-specific headers, does not comply with robots.txt, and operates with the user’s logged-in session privileges—including access to cookies, logins, extensions, and stored credentials.

3. Platform Defense: Bot Detection and Anti-Scraping Controls

The ruling does not leave platforms defenseless. Amazon and other e-commerce giants have deployed sophisticated technical measures to detect and block AI agents—measures that remain legally viable outside the CFAA context.

Amazon’s Anti-Agent Arsenal (2025–2026):

| Control | Description |

||-|

| robots.txt Blocking | Amazon progressively blocked crawlers from all major AI models throughout 2025 |
| TLS Fingerprinting | Detects automated clients by analyzing TLS handshake patterns |
| Behavioral Scoring | Scores sessions based on navigation patterns, idle time, and interaction density |
| CAPTCHA Escalation | Triggers CAPTCHA challenges when behavioral anomalies are detected |
| Per-IP Rate Caps | Limits requests per IP address to prevent high-volume scraping |
| AI Agent Policy (March 2026) | Requires all automated seller tools to register through SP-API, maintain 12-month audit trails, and self-identify as automated systems |

Step-by-Step: Deploying an Anti-Agent Detection Stack

Implement TLS Fingerprinting: Use tools like JA3/JA4 to fingerprint TLS handshakes. Automated tools often use different TLS configurations than standard browsers.

2. Deploy Behavioral Analytics: Monitor session characteristics:

Click density: Bots generate more systematic navigation patterns
Idle time: Bots have fewer idle periods than humans
Mouse movements: Bots lack natural mouse trajectories

Enforce Rate Limiting: Implement per-IP and per-session rate caps. Residential proxy rotation at high volume is a red flag.
Require Self-Identification: Mandate that all automated tools identify themselves via user-agent strings or API registration.
Prohibit CAPTCHA Bypass: Explicitly forbid automation tools from solving or bypassing CAPTCHA challenges.

Linux Command: Analyzing Suspicious Traffic with tcpdump

 Capture HTTPS traffic to Amazon and filter for suspicious patterns
sudo tcpdump -i eth0 -1n -A 'host amazon.com and port 443' | \
grep -E "User-Agent|Cookie|Accept-Encoding" | \
awk '{print $0}' | tee amazon_bot_traffic.log

Analyze request frequency per IP
sudo tcpdump -i eth0 -1n 'host amazon.com' | \
awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -1r | head -20

Windows Command: Monitoring Outbound Connections

 Monitor established connections to Amazon IP ranges
Get-1etTCPConnection -State Established | 
Where-Object {$<em>.RemoteAddress -like "176.32." -or $</em>.RemoteAddress -like "205.251."} | 
Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State

Log process-level network activity
netsh trace start capture=yes provider=Microsoft-Windows-Kernel-1etwork tracefile=C:\traces\amazon_traffic.etl

CFAA Compliance for AI Developers: A Practical Guide

The 9th Circuit’s ruling provides a roadmap for AI developers to design agentic systems that minimize CFAA exposure. However, the court explicitly left open the possibility of other claims—including breach of contract, tortious interference, and state-law claims.

Compliance Checklist for Agentic AI Systems:

[ ] User-Device Routing: Ensure that all direct connections to third-party platforms originate from the user’s device, not your infrastructure.
[ ] Explicit User Delegation: Require affirmative user action—not just passive consent—for each agentic transaction. The court emphasized that the user directs the agent.
[ ] Transparent Agent Identification: Consider using identifiable user-agent strings. Perplexity’s refusal to do so was cited as a factor in Amazon’s lawsuit.
[ ] Data Minimization: Avoid storing user credentials or session data longer than necessary. Perplexity was ordered to delete collected data from Amazon’s protected areas.
[ ] Terms of Service Awareness: Even if CFAA liability is unlikely, violating a platform’s ToS can expose you to breach-of-contract claims.

Code Example: Implementing User-Device Routing (Conceptual)

 BAD: Server-side direct connection (higher CFAA risk)
import requests
def scrape_amazon_server_side(product_id):
response = requests.get(f"https://www.amazon.com/dp/{product_id}")
return parse_price(response.text)

GOOD: User-device routing with instruction passing (lower CFAA risk)
 This runs on the user's browser, not your server
def navigate_amazon_user_device(instruction):
 Browser executes this directly - your server only sends instructions
execute_in_browser(instruction)  e.g., "click button at (x,y)"
return capture_browser_state()  send screenshot back for analysis

The Infrastructure Tax: Why Platforms Really Fight AI Agents

Beyond legal arguments, the ruling exposes a commercial reality: AI agents impose a massive infrastructure tax on platforms while generating zero ad revenue.

The Economics of AI Scraping:

When a bot executes 1,000 product queries per minute, and a retailer serves a standard 3MB webpage—complete with high-res hero banners, heavy JavaScript, and CSS for visual layout—that consumes 3GB of bandwidth and compute per minute. The AI script simply parses the underlying DOM for price and inventory data, discarding the visual elements entirely.

The retailer pays 100% of the infrastructure cost to serve rich media to an entity without eyes, yielding a clinically guaranteed 0% clickthrough rate.

Amazon’s advertising business generates tens of billions of dollars at massive margins. When a user delegates shopping to an AI agent, they bypass the ad-supported discovery experience entirely—a direct threat to Amazon’s business model. As Perplexity stated: AI agents “don’t have eyeballs to see the pervasive advertising Amazon bombards its users with”.

Mitigation Strategies for Platforms:

API-First Access: Require all automated interactions to use registered APIs with usage-based pricing
Compute Cost Recovery: Implement rate limiting that scales with usage volume
Value-Added Services: Offer premium APIs for AI agents that include structured data feeds (reducing the need for scraping)
Differentiated Content: Serve different content to identified bots (e.g., text-only versions with lower bandwidth)

Agentic AI and the Future of the Transactional Web

The 9th Circuit’s ruling is the first federal appeals court decision to address whether AI agents acting on behalf of users can legally access online platforms. Its implications extend far beyond e-commerce.

Sectors Most Affected:

| Sector | Agentic AI Application | Legal Precedent Impact |

|–|-|-|

Step-by-Step: Designing a Compliant Agentic System for Any Sector

User Authorization First: Obtain explicit, revocable user consent for each action domain
Device-Centric Architecture: Keep all direct platform connections on the user’s device
Audit Trail: Maintain cryptographically verifiable logs of all user delegations and agent actions
Rate Limiting: Implement per-user rate limits to avoid triggering platform defenses
Transparency: Clearly disclose agentic behavior to both users and platforms

What Undercode Say

User agency prevailed over platform control. The 9th Circuit recognized that when a customer chooses to use an AI tool to shop, that choice belongs to the customer—not the platform. Amazon’s “customer obsession” principle doesn’t entitle it to dictate how customers shop, only what they can buy.
The CFAA is not a Swiss Army knife for platform protection. The court’s narrow interpretation of “access” sends a clear signal: the CFAA was designed to punish computer break-ins, not to regulate competition in the AI economy. Platforms that want to block AI agents must develop technical solutions—not rely on a 1986 anti-hacking statute.
Agentic AI is inevitable; the question is how we govern it. The ruling doesn’t resolve all legal questions—it merely establishes that CFAA liability doesn’t attach to user-directed agents. Issues of data privacy, consumer protection, antitrust, and contractual liability remain wide open. Regulators and courts will spend the next decade wrestling with these questions.
The infrastructure war is just beginning. Platforms will continue to deploy technical countermeasures against AI agents, and AI developers will continue to develop evasion techniques. This cat-and-mouse game will drive innovation in both bot detection and agentic AI—and ultimately benefit users through better, more efficient tools.

Prediction

+1 Agentic AI adoption will accelerate dramatically across e-commerce, travel, and financial services, as the 9th Circuit’s ruling removes a major legal uncertainty for AI developers. Expect a wave of new agentic tools launching within 12–18 months.
-1 Platforms will increasingly deploy aggressive technical countermeasures—including TLS fingerprinting, behavioral analysis, and CAPTCHA escalation—that may inadvertently block legitimate users. Amazon has already mistakenly flagged real customers as bots.
+1 The ruling will spur legislative action. Congress is likely to consider updates to the CFAA or new AI-specific legislation that clarifies the legal status of agentic systems. This could create a more predictable regulatory environment for AI development.
-1 The infrastructure cost of AI scraping will force platforms to implement usage-based pricing or API access fees, potentially shifting costs from platforms to AI providers—and ultimately to end users.
+1 The “user-directed agent” framework established by the 9th Circuit will become the industry standard for compliant agentic AI design, creating a competitive advantage for platforms that embrace—rather than resist—the agentic web.

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eEbe8EFK – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post