Amazon v. Perplexity: the agent-blocking ruling that didn't survive appeal

You hand a shopping agent your Amazon login and tell it to do the boring part: reorder the coffee, watch for the price to drop, check out when it hits your number. You gave it permission. A federal appeals court has now ruled on whether your permission was ever yours to give, and the answer is narrower than the headlines.

Amazon won a court order in March that barred Perplexity’s Comet agent from shopping on Amazon with people’s own logins.¹ A three-judge panel of the Ninth Circuit heard Perplexity’s appeal on June 11² and, on August 4, 2026, vacated that order and sent the case back to the district court.³ The opinion is published and precedential, and it settles far less than the question the case started with: can an agent you hire act for you on the sites you already use?

The short version: this fight turned entirely on which of two permissions counts; whether Comet is any good never came up. Amazon’s position was that a site can refuse an automated agent even when you, the account holder, invited it in. Perplexity’s was that an agent following your instruction is just you, using a different browser. The Ninth Circuit sided with Perplexity on the narrow question of who does the accessing, and left almost everything else open. Keep treating any “shop for me” agent as blockable: put it on a card you can cancel, expect a refusal partway through checkout, and do not wire it into anything you could not redo by hand.

Editor’s note, updated August 2026: The Ninth Circuit decided the appeal on August 4, 2026, vacating the injunction and remanding to the district court. This piece now covers the ruling and its limits. The case itself is not over.

For you if you use, or are tempted by, an agent that logs into sites and acts for you: shopping, booking, paying bills. Skip it if your AI only drafts and chats and never touches your accounts. This one will not reach you.

What Amazon v. Perplexity is

Formally the case is Amazon.com Services LLC v. Perplexity AI, Inc.: district docket No. 3:25-cv-09514 in the Northern District of California, appealed to the Ninth Circuit as No. 26-1444.⁴ Amazon brought it under the Computer Fraud and Abuse Act (the CFAA), the 1986 federal anti-hacking law, over Perplexity’s Comet reaching Amazon accounts with each user’s permission but without Amazon’s own.¹ The question the appeal had to answer: can a site turn away an automated agent that its own account holder authorized?² The panel answered a narrower version of it and expressly left the rest open.³

Amazon says a locked door beats your invitation

Amazon’s complaint sidesteps theft and damage entirely. Its claim is narrower and stranger: Comet came in without Amazon’s permission, even though it had yours.

Amazon sued Perplexity in November 2025, after an October cease-and-desist demanding the company stop disguising Comet as an ordinary Chrome browser instead of identifying it as an AI agent.¹ The legal hook is the Computer Fraud and Abuse Act, the federal anti-hacking law, plus its California counterpart. In March, U.S. District Judge Maxine Chesney granted a preliminary injunction (a court order that holds before any full trial) after finding Amazon had “strong evidence” that Comet accessed user accounts “with the Amazon user’s permission, but without authorization by Amazon.”¹

Read that finding twice, because it is the whole case. The court treated your say-so and Amazon’s say-so as two separate locks. You can open one. Only Amazon can open the other.⁵

That order is no longer in force. The Ninth Circuit stayed it in mid-March while the appeal ran,⁶ and on August 4, 2026 the panel vacated it outright, holding that Amazon is unlikely to win on what the hacking law calls “access,” because the user, with the agent’s help, is the one reaching Amazon’s computers.³

A 1986 hacking law is deciding who gets to shop for you

Your account is your key. The case is whether Amazon can still turn your agent away at the door.

The statute doing the work here was written in 1986 to punish breaking into computers.² Pointing a hacking law at a shopping errand you asked for is exactly the stretch the appeals judges had to rule on. One member of the panel, District Judge John Hinderaker (a trial judge temporarily filling an appellate seat), said it plainly at argument: the case is hard “in part because we are dealing with a statute from 1986. It’s not really built for these circumstances.”²

Whether “without authorization” means “without the user’s permission” or “without the platform’s permission” is the hinge the whole agent economy now swings on.

Both sides have a straight-faced case

Strip out the branding and each side is defending something real.

Perplexity’s lawyer, Chris Michel of Quinn Emanuel, made the competition point at argument: Amazon is stretching a criminal statute because it “wanted its own customers to access its website its preferred way.”² Amazon’s answer is that “its preferred way” marks the difference between a site the company can run and a site anyone can automate through.

Both can be true. That is what makes it a real case.

What the judges kept poking at, and what it does not tell us

At the June 11 argument, Hinderaker asked the question with no clean answer yet: “Does an AI agent ever have intent?”² The hacking law is built around a person knowingly exceeding their access. An agent does not “know” anything; it does what its user set it to do. The panel, Circuit Judges Milan Smith and Eric Tung with Hinderaker sitting by designation, submitted the case that day² and issued its opinion on August 4, 2026, written by Judge Smith.³

A hard question at oral argument does not preview the outcome. Judges probe the weak spot of the side they agree with as often as the side they oppose. Read the questions as a map of what is genuinely unsettled.

The ruling landed on August 4, 2026. What follows is what it decided, and what it deliberately left alone.

What the ruling settled, and what it did not

Perplexity’s reading held, on one question. The panel asked whether Perplexity uses the Assistant to access Amazon’s computers and answered no: “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”³ Receiving screenshots of your browser and sending the Assistant instructions did not make Perplexity the one at the door.

The court then said, at unusual length, what it was not doing. “We do not establish a new legal regime governing agentic AI,” the opinion reads, and it confines itself to “access” under the Computer Fraud and Abuse Act “on the record before us.”³ It left open whether a different record, showing more control by Perplexity over the Assistant, would come out the other way. It did not reach tort claims. It never decided the disguise question, recording only that the parties dispute whether Perplexity knowingly altered the user-agent string.³

One limit reaches you directly. In a footnote, the panel wrote that the outcome “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.”³ The hacking law is off the table. The terms of service you clicked are not. A store that wants your agent out has a slower path to the same result, and this ruling does not close it.

Whichever way the rest of the case goes, the reliability lesson does not move: an agent acting for you can be refused, paused, or redirected by a party that is not you. That risk rides along with hiring any software to act on sites you do not control, Comet or otherwise. The same tension shows up in whose interests your shopping agent actually serves and what a browser agent can do once it holds your logins.

How to run a shopping agent now

• Keep agents on a leash you can pull. A virtual or cancelable card, a spending cap, and no saved payment method the agent can reuse unattended.
• Expect a refusal partway through. Treat a mid-checkout block as a normal outcome and confirm the order actually went through before you count it done.
• Do not automate the irreversible. If a step cannot be undone by hand in a minute, do not let an agent take it alone. The same caution that guards you against a calendar invite that hijacks your assistant applies here.
• Watch the docket. The Ninth Circuit sent the case back to the district court, No. 3:25-cv-09514, after deciding the appeal, No. 26-1444.⁴³ That is where the rest of it plays out.

The headlines said who won. The thing worth keeping is quieter: the moment you let an agent act for you, a third party you never hired gets a vote on whether it can. Designing for that (a refusal you expected, a cap you set, a step you kept for yourself) is the whole game. It is the same discipline our research desk applies to agents in production, in what it takes to run reliable AI agents.

Footnotes

1. CNBC, “Amazon wins court order to block Perplexity’s AI shopping agent.” The November 2025 suit, the October cease-and-desist over Comet disguising itself as Chrome, the March 9, 2026 preliminary injunction from U.S. District Judge Maxine Chesney under the Computer Fraud and Abuse Act, and the “with the Amazon user’s permission, but without authorization by Amazon” finding: https://www.cnbc.com/2026/03/10/amazon-wins-court-order-to-block-perplexitys-ai-shopping-agent.html ↩ ↩² ↩³ ↩⁴

2. Courthouse News Service, “Perplexity AI asks Ninth Circuit to allow shopping tool on Amazon.” The June 11, 2026 oral argument, the panel (Circuit Judges Milan Smith and Eric Tung, with District Judge John Hinderaker sitting by designation), the statute’s 1986 origin, Hinderaker’s “statute from 1986 … not really built for these circumstances” and “Does an AI agent ever have intent?” questions, Perplexity counsel Chris Michel’s browser and competition arguments, and the case being submitted that day with no ruling: https://www.courthousenews.com/perplexity-ai-asks-ninth-circuit-to-allow-shopping-tool-on-amazon/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

3. Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), published opinion by Judge Milan D. Smith, Jr., joined by Judge Eric C. Tung and District Judge John C. Hinderaker sitting by designation. The panel vacated the preliminary injunction and remanded, holding Amazon unlikely to succeed on the “access” prong: “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.” The opinion limits itself expressly (“We do not establish a new legal regime governing agentic AI”), and footnote 5 adds that the outcome “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users”: https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

4. CourtListener, “Amazon.com Services LLC v. Perplexity AI, Inc.” District docket No. 3:25-cv-09514 (N.D. Cal.): https://www.courtlistener.com/docket/71874820/amazoncom-services-llc-v-perplexity-ai-inc/ ↩ ↩²

5. Jones Day, “Authorized by the User, Blocked by the Platform: Testing the Legal Limits of AI Agents.” The user-authorization-versus-platform-authorization split at the center of the claim, and that this is an early judicial test of computer-access law applied to agentic AI: https://www.jonesday.com/en/insights/2026/05/authorized-by-the-user-blocked-by-the-platform-testing-the-legal-limits-of-ai-agents ↩

6. CyberScoop, “Appeals court temporarily pauses order blocking Perplexity’s AI shopping agent on Amazon.” The Ninth Circuit’s temporary administrative stay of the injunction, granted in mid-March 2026, while it considers Perplexity’s request for a longer pause during the appeal: https://cyberscoop.com/perplexity-comet-ai-shopping-agent-amazon-lawsuit-ninth-circuit-stay/ ↩