Perplexity Beat Amazon Because of Where Its Code Runs
August 9, 2026
10 min read
AI & Technology
August 9, 2026
10 min read
On August 4, a unanimous Ninth Circuit panel vacated the preliminary injunction that had kept Perplexity's Comet browser and shopping assistant off Amazon.com. The holding: under the Computer Fraud and Abuse Act, an AI agent is a tool, not a person. When a user points an agent at a website, it is the user who accesses it.
That is being read this week as a green light for agentic commerce. It is not, and the gap between what the court said and what people think it said is where founders will get hurt. The more useful thing in the opinion is narrower and more actionable: the fact that decided the case was architectural. Perplexity won partly on how it built Comet.
Comet does not work the way most people assume an AI shopping agent works. Perplexity's servers never talk to Amazon's servers. The Assistant takes a screenshot of the page on the user's own machine, sends that image to Perplexity for processing, and gets back navigation instructions that the user's computer then executes. Every packet that reaches Amazon comes from the user's device, over the user's connection, in the user's session.
The court's reasoning follows directly from that. “Access” under the CFAA means entering a computer system, and the statute contemplates access by a person. The agent is instrumentality — the panel wrote that it is “a tool, not a person for statutory purposes,” and that “the focus of the inquiry is still on the person accessing or causing the access.” So it was the user who accessed Amazon, with the help of Perplexity's agent.
The panel reinforced this with the rule of lenity. The CFAA is a criminal statute. If Amazon's theory were right — that the agent's operator is the one accessing — the same logic would expose ordinary people to criminal liability for using an AI assistant to buy something. Courts avoid readings of criminal statutes that sweep that broadly, and this one did.
Why this should change how you read your own architecture diagram
Client-side versus server-side execution has always been a decision about latency, cost, and where credentials live. As of August 4 it is also a decision about your legal posture. The Ninth Circuit's analysis rests on the absence of server-to-server communication. An agent whose backend fetches the page itself is not obviously covered by this reasoning, and the court did not say it was.
The panel was unusually explicit about its own limits: “We do not establish a new legal regime governing agentic AI.” Take that literally. Five things did not change.
Here is the part that should concern you more than the win reassures you.
If anti-hacking law no longer reaches the agent's operator, platforms will move the fight to contract. That is the obvious response and Eric Goldman has already flagged where it leads: sites tighten their terms to prohibit agent-assisted access, and the person bound by those terms is the account holder. Your user.
Read the logic of the win again and you can see the trap inside it. The court held that your user is the one accessing the site. That is exactly the premise a platform needs to argue your user is the one in breach — and to suspend their account rather than sue you. You escape liability by successfully arguing that your customer is the actor. Winning that argument twice is not obviously good for your product.
So the realistic near-term future is not open agent access. It is a mix of tightened terms, more aggressive bot detection, and account-level enforcement against end users — with a legal question resolved in the agent industry's favour sitting underneath it, doing less work than the headlines suggest.
I am not a lawyer and none of this is legal advice — if agent access to third-party platforms is load-bearing for your product, that is a conversation to have with counsel, not with a blog post. What I can offer is the engineering observation, and it is the one worth carrying.
A systems-design choice made for latency and credential-handling reasons turned out to determine the outcome of a federal appeal. Perplexity almost certainly did not build Comet client-side in order to win a CFAA case. It built it that way because screenshotting locally is a sensible way to operate inside a user's authenticated session, and the legal benefit fell out of it.
That is the pattern to internalise. This has been the week for it: on Friday, a chip company betting that where a model physically lives changes its economics; today, a court finding that where an agent physically runs changes who is legally acting. In both cases the boundary that mattered was a deployment boundary, not a product decision. As agents start doing things with real-world consequences — spending money, signing up, sending mail, holding credentials — the question “whose computer is this running on?” stops being an implementation detail and starts being one of the load-bearing facts about your company.
