Amazon is suing Perplexity's Comet under CFAA. Every agent dev should read this.

What happened

Amazon.com Services, LLC filed suit against Perplexity AI in the Northern District of California, alleging that Perplexity's Comet browser — the agentic browser that shops, checks out, and clicks through sites on a user's behalf — accessed Amazon.com in violation of the federal Computer Fraud and Abuse Act (CFAA) and California's Comprehensive Computer Data Access and Fraud Act (CDAFA). The Ninth Circuit's August 4, 2026 opinion in *Amazon v. Perplexity* (No. 26-1444) is now the appellate vehicle that will decide whether an AI agent using a user's own logged-in session counts as "unauthorized access" under those statutes.

The core factual claim from Amazon: Comet doesn't just render pages, it programmatically navigates the product catalog, adds to cart, and completes purchases without ever surfacing Amazon's UI to the user. Amazon says it sent cease-and-desist letters, applied technical countermeasures, and Perplexity kept going. Perplexity's defense is that Comet is a browser — the user is the one accessing Amazon, Comet is just the window through which they do it.

The Ninth Circuit has to decide whether accessing a site through a user's own credentials, at the user's own direction, but with an AI as the intermediary, is meaningfully different from accessing that site with Chrome. That question sounds narrow. It isn't. It's the entire legal foundation of the agentic web.

Why it matters

This case sits directly on top of *hiQ Labs v. LinkedIn*, the 2022 Ninth Circuit decision that narrowed the CFAA and said scraping public data doesn't violate it. But *hiQ* was about a scraper hitting logged-out public pages. Amazon v. Perplexity is the opposite fact pattern: a logged-in session, a private commerce surface, and an automated agent doing things a human normally does. If *hiQ* pulled the CFAA back from an aggressive read, Amazon is now trying to push it forward in a direction hiQ didn't foreclose.

The HN commentariat immediately zeroed in on the standing question. As user eigencoder put it: "What Perplexity does, from my perspective, is essentially the same as when I allow Firefox, Chrome, or Safari to see my credentials and access Amazon's website." That framing is doctrinally correct and rhetorically powerful, but it papers over the thing Amazon actually cares about, which isn't the credentials — it's the eyeballs.

Headless Amazon is an existential problem for Amazon's ad business, not its commerce business. User gz5 nailed the business logic: "AI is a legit threat to Amazon because headless Amazon makes it more difficult for Amazon to sell ads, which is a large part of their revenue." Amazon's advertising unit did roughly $50B in 2024 revenue. Sponsored placements only work if a human sees the search results page. An agent that reads structured product data, applies a user's stated preferences, and clicks buy never sees the ad slot — and Amazon can't charge for an impression that didn't happen.

That's the real fight. The CFAA is the weapon; ad revenue is the target. theturtletalks made the point sharply: "People don't realize how big of a threat LLMs are to marketplaces like Amazon, because down the line people will just be talking to AI agents to help them find products, check out, do all of these things." If that future arrives, Amazon becomes a fulfillment API — a commodity backend behind whoever owns the agent. Every marketplace is watching this case for the same reason.

There's a second layer worth naming. Amazon has technical countermeasures — CAPTCHAs, bot detection, TLS fingerprinting, behavioral heuristics. Under the CFAA post-*Van Buren*, the question of "authorization" often collapses into whether the defendant bypassed a technological gate. If the Ninth Circuit says Comet bypassing bot detection counts as unauthorized access, that ruling reaches far beyond Perplexity. It reaches Playwright, it reaches Puppeteer, it reaches every synthetic monitoring tool your ops team runs against a third party, and it reaches every agent framework — LangChain browser tools, OpenAI's Operator, Anthropic's computer use, and the long tail of open-source scrapers — that navigates a site the site doesn't want navigated.

What this means for your stack

If you're building anything that drives a browser on a user's behalf against a third-party site, three things change now, before the ruling even lands.

First: assume the user's consent is not a defense. The whole industry has been operating on the informal theory that if the user logged in and told the agent to do the thing, you're fine. Amazon is directly challenging that theory. Until this case resolves, treat "the user authorized it" as an argument you'd have to win in court, not a settled premise. That means keeping audit trails of user consent, keeping the agent's actions bounded to what the user explicitly directed, and — critically — not routing agent traffic through infrastructure that looks like scraping infrastructure (residential proxies, rotating IPs, headless fingerprint spoofing).

Second: the endpoints matter more than the intent. If you're building agent tooling, prioritize sites with public APIs, MCP servers, or affiliate programs over sites you have to scrape. The legal risk of agentic access to Stripe's dashboard (which has an API) is categorically different from agentic access to a competitor's storefront (which does not). The commerce sites that will survive the agent transition are the ones that ship an agent-friendly interface before they get one forced on them. Shopify already has this. Amazon, notably, does not.

Third: contract terms are the real front line, not the CFAA. Even if Perplexity wins on the CFAA claim, Amazon's terms of service almost certainly prohibit automated access, and breach-of-contract claims have a much lower bar than federal criminal statutes. Your agent might not be committing a federal crime; it might still be violating a ToS your user clicked through and never read. Read the ToS of every surface your agent touches, and route around the hostile ones.

Looking ahead

The Ninth Circuit will rule sometime in the next several months, and whichever way it goes, the losing side appeals. This is a Supreme Court case in waiting — the doctrinal split between "agent as tool of user" and "agent as unauthorized bot" is too big and too consequential to end at the circuit level. In the meantime, build like the ruling could go either way: keep your agent's behavior boring, keep your consent trail clean, and start pushing every platform you depend on to publish a first-class agent interface. The ones that don't are going to spend the next five years suing their own users' software.