The Computer Fraud and Abuse Act turned 40 this year. Enacted in 1986, drafted for a world of dial-up intrusions and mainframe credentials, it has spent four decades being stretched to cover scrapers, bots, password sharing, and terms-of-service violations. On August 4, 2026, it got its first federal appellate test against an AI shopping agent — and the injunction built on it did not survive. A unanimous Ninth Circuit panel vacated the order blocking Perplexity, holding that Perplexity does not "access" Amazon's computers when a user tells Perplexity's Assistant to log into that user's own Amazon account and place an order. The user accesses. The agent is a tool. Amazon lost the preliminary injunction, not the lawsuit; the case goes back to the district court.

That is a meaningful shift in leverage. User-directed agents just got federal breathing room on the open web, and merchants just learned that the country's main anti-hacking statute is a weak off-switch against a browser-resident agent operating inside a customer's own session. The news peg is narrow and specific: the panel vacated the preliminary injunction that U.S. District Judge Maxine Chesney entered in March 2026, which had blocked Comet from reaching logged-in Amazon pages. The case itself, filed November 2025 in the Northern District of California, continues.

The market signal is the speed of institutional uptake. Within 48 hours, Cooley, Wilson Sonsini, Ropes & Gray, and Ballard Spahr had client alerts out. The Electronic Frontier Foundation and the Knight First Amendment Institute — both amici — declared it a win. eMarketer told retail clients that AI shopping agents may now be harder to shut out. This is the baseline everyone will argue from going into holiday 2026, the first peak season where agent traffic is material and the legal question is no longer purely theoretical. Two stacks now sit side by side: merchant-permissioned protocol rails, and user-directed browser agents that don't ask. Liability didn't disappear when the CFAA claim weakened. It moved — onto the user, and into a gap nobody has filled.

What the Ninth Circuit actually held

The opinion, authored by Judge Milan D. Smith, Jr. in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, is narrower than the headlines and more consequential than its narrowness suggests.

The core statutory move: CFAA § 1030(a)(2) and California's CDAFA analog both turn on whether a defendant "accesses" a protected computer without authorization. The panel held that Perplexity does not. In the opinion's words, the statute "contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes." And: "it is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com."

The panel also rejected the theory that Perplexity's own data flows constituted access. Perplexity's receipt of screenshots or instructions to the Assistant, the court wrote, "by themselves, do not mean that Perplexity has 'accessed' (gained entry) to Amazon's servers."

Two guardrails matter for anyone reading this as a green light. First, the court applied the rule of lenity — the CFAA is a criminal statute, and ambiguity gets read narrowly. The panel warned that Amazon's construction "could expose users themselves to criminal liability," calling that reading "legally baseless" and "bad policy." Second, the court fenced its own holding: "Our holding here is limited to 'access' as contemplated by the CFAA and as applied to the Assistant's interactions with Amazon.com on the record before us, not the broader legal landscape surrounding agentic AI."

On the equities, the panel found Amazon's irreparable-harm showing weak and abstract, per the Knight Institute's summary, and weighed innovation and user choice against the injunction. The injunction is vacated and the case is remanded. Amazon's breach-of-contract, terms-of-service, tort (including trespass to chattels), and trademark theories are all still live. Only the CFAA path got materially harder.

Why the architecture decided the case

Read the opinion as an engineering document and it becomes a specification.

When a user directs the Assistant on Amazon.com, Comet takes screenshots of the browser view from the user's own device, ships those screenshots to Perplexity's servers for analysis, and receives navigation instructions back to the user's browser. Perplexity's servers never open a connection to Amazon's servers. The credentials are the user's. The session is the user's. The TCP connection is the user's.

That is why the browser analogy landed. As reported across coverage of the ruling, the panel reasoned that the agent is no more Perplexity accessing Amazon than Safari is Apple accessing Amazon. It is also why the panel could distinguish Facebook v. Power Ventures, where a third party used shared credentials to reach private areas from its own infrastructure, and why this is not simply hiQ v. LinkedIn redux — Amazon's live claim was about logged-in account pages, not public listings. Do not flatten this into "public data is fair game." That was never the fight here.

The operative lesson from Wilson Sonsini's analysis and other law-firm reads: a different architecture could produce a different CFAA result. An agent that fetches merchant pages or hits merchant endpoints directly from developer-controlled servers, using stored user credentials, does not obviously inherit this shield. Architecture is now a legal fact, not just a latency decision. If your agent runtime lives in the cloud rather than in the user's browser, your general counsel should know that before your next release.

How Amazon got here

Amazon sued in November 2025 (N.D. Cal., 3:25-cv-09514), alleging that Perplexity was, in Reuters' description of the complaint, "covertly accessing private Amazon customer accounts through its Comet browser and associated AI agent, which can log into users' online shopping accounts and place orders on their behalf." The complaint bundled CFAA and CDAFA claims with terms-of-service violations, degraded shopping experience, and privacy concerns. Contemporaneous coverage also flagged the advertising exposure: agents that shop don't see ads.

Identification was a flashpoint. Amazon asked Perplexity to adopt an identifying user-agent string so Amazon could detect and block the agent. Perplexity did not, and Amazon treated the omission as evasion. The two companies had agreed in 2024 to pause agentic features on Amazon; Perplexity later re-enabled them.

In March 2026, Judge Chesney granted the preliminary injunction, finding Amazon likely to succeed, citing "strong evidence" the agent violated U.S. law and more than $5,000 in response costs — the CFAA civil damages threshold. Perplexity appealed. The Ninth Circuit stayed the injunction pending review, then vacated it on August 4.

Amazon's post-ruling statement, carried by the SF Chronicle and Engadget: it respectfully disagrees, remains confident in its case, and is evaluating next steps including en banc rehearing or a Supreme Court petition. Perplexity's chief communications officer told Courthouse News the company will keep fighting for users' right to choose their preferred AI tools. Jake Karr of the Knight Institute called the decision "a win for user control and for the independent journalism and research that help the public understand how online platforms shape public discourse."

Two doors into the store

The practical output of August 4 is that agentic commerce now has two structurally different entry paths, and merchants have to have a policy for both.

Door one is permissioned. Google's Universal Commerce Protocol, the OpenAI/Stripe Agentic Commerce Protocol, Visa's Trusted Agent Protocol and Intelligent Commerce, Mastercard Agent Pay, and x402 all assume the merchant grants entry, the agent presents credentials, and both sides get structured data, attribution, and a dispute trail. That's the front door, and it has been built out steadily over the past year.

Door two is the customer's own session. A Comet-style agent sees what the user sees and clicks what the user can click. It carries no special credential, appears as ordinary session traffic, and — after August 4 — cannot easily be characterized as federal hacking on this architecture. eMarketer's read is blunt: retailers will find CFAA injunctions harder to win on these facts.

The strategic error would be assuming door one makes door two go away. It does not. Permissioned rails give merchants control over the agents that opt in. The ruling establishes that agents which do not opt in still have a lawful path — through the customer.

The liability vacuum

The browser analogy solves a statutory problem and creates an operational one. If the legal actor is the user, then the user owns the consequences of what the agent does. Forkast's analysis puts the pressure point plainly: that framework assumes users can supervise autonomous agents, and the same piece notes only 14% of consumers trust AI to execute purchases without verification. Techdirt's framing is the compact version — the AI agent can't violate the hacking law, but the human user might.

For payments teams, this makes disputes messier rather than cleaner. A wrong SKU, a duplicate order, an agent that accepts a price change mid-checkout — if the "accessing" party is the cardholder, the merchant's chargeback defense rests on evidence it probably isn't capturing today: was there an agent in the session, what did the user authorize, what did the agent do without a confirmation step. Consumer dispute rights survive delegation to an agent; the evidentiary record on the merchant side generally does not exist yet. Payment networks have been trying to fill this gap privately with agent credentials and mandates, which is exactly why Visa TAP and Mastercard Agent Pay exist. Those are private-ordering answers to a public-law hole the Ninth Circuit just widened.

The identity problem is being named in two places at once. Separately this month, U.S. Intelligence Community CIO Douglas Cossa argued that AI agents need "birth certificates" — digital identities and verifiable credentials issued at creation — because agentic systems break least-privilege assumptions, with IC enterprise-identity pilots planned for fall 2026. Different domain, same unresolved question: who is the actor.

What still works for merchants — and what does not

What does not work as a complete strategy: robots.txt, user-agent blocking, and CFAA cease-and-desist letters. A screenshot-based agent running on the user's device with the user's credentials presents as the user. There is no string to block, and after August 4 the demand letter's central threat is much weaker on these facts.

What still works, and now matters more: terms of service and contract claims, which the Ninth Circuit expressly left untouched. Trespass to chattels. Trademark and IP theories. Rate limiting and behavioral challenges at the session layer. Step-up authentication at checkout. And a permissioned API path that gives agents a reason not to drive your storefront UI at all.

That last point is the one merchants underrate. Every agent you refuse to serve through a sanctioned channel becomes an agent operating your consumer front end while impersonating a shopper — invisible in analytics, unattributed in ad measurement, and undocumented in your dispute evidence. Blocking is now partly a fiction. Channeling is the achievable goal.

What happens next

The procedural posture is a preliminary-injunction appeal, reviewed for abuse of discretion on a preliminary record. It is not a merits judgment. Amazon can seek panel rehearing or rehearing en banc, and has said Supreme Court review is on the table. Remand puts the contract, TOS, and tort claims back in front of Judge Chesney, where the fight over what Amazon's terms actually prohibit — and whether a user's agent binds the user to them — becomes the main event.

Elsewhere, the commercial context is doing its own thing. Commerce.com reported Q2 2026 on August 6 with an agentic roadmap — Feedonomics ACE feeding OpenAI and Gemini, a B2C Brand Agent and Conversational Search slated for early Q4 — alongside cut guidance. The legal door for user-directed agents opened in the same two-week window that a public commerce platform's agentic story met a guidance cut. Both facts are real. Neither settles the other.

What to do before the next filing

A 40-year-old statute just got its first appellate application to agentic shopping, and the answer was that the user accesses, not the developer — a result that turned on screenshots taken from the customer's device rather than a server-to-server call. That leaves two doors into every storefront, a liability gap where the CFAA used to sit, a live docket full of contract and tort claims, and a holiday 2026 season that will run with all of it unresolved. Here is the work.

Start with a driveability audit. Have someone run a logged-in browser agent against your own checkout and document exactly what it can do — add to cart, change address, apply a promo, complete payment — and where a human confirmation is actually enforced. Then pick a posture and write it down: identify-and-allow known agents, or challenge everything unidentified at session and checkout layers. Half-postures produce the worst outcome, which is unidentified agent traffic you neither block nor measure. Stand up a permissioned path — UCP, ACP, or your own commerce API — so the agents you want are not forced to impersonate a shopper to transact. Update your terms of service to address automated session actors explicitly, since contract is now your strongest surviving lever. And instrument agent-session evidence today: session signals, confirmation timestamps, and authorization artifacts you can put in front of an issuer in January.

For agent builders: document your execution model in writing — that actions run in the user's session, under user credentials, initiated by user instruction — because that record is now legally load-bearing. Do not assume the shield travels if you move to server-side fetches for speed or cost. And budget for TOS litigation regardless; the CFAA got harder, contract did not.

For counsel: treat this as a preliminary-injunction standard case, not a merits holding, when advising either side. Preserve every non-CFAA theory. And watch the rehearing clock — under Federal Rule of Appellate Procedure 40, a petition for rehearing runs 14 days from judgment. Judgment entered August 4, 2026, which puts the deadline at roughly August 18, 2026. That is the next hard legal date; holiday 2026 is the next hard commercial one.

Run the driveability audit this week, before August 18 tells you whether this ruling is the ceiling or the floor.

Sources