An American appeals court has decided that when an AI agent logs into your Amazon account and buys something, the party reaching into Amazon is you. That single act of attribution was enough to lift the order that had kept Perplexity’s agentic shopping tools off the platform.
The Ninth US Circuit Court of Appeals, sitting in San Francisco, set aside the injunction, The Decoder reported, citing Reuters. Amazon had argued that Perplexity’s agents broke a federal computer fraud statute, which turns on obtaining information from a computer without permission. The panel judged that Amazon was unlikely to prevail on that argument, because the person supplying credentials and issuing the instruction is the one gaining entry. The tool carrying out the request is not a separate trespasser.
Read the procedural posture carefully, because the headline overstates what has happened. This was an appeal of a preliminary injunction, an order issued early to hold a position while litigation continues. The panel assessed how likely Amazon was to win eventually, not whether it will. The underlying case has not been decided, nothing has been ruled on the merits, and Amazon may still prove its claims at trial. What changed is that Perplexity is no longer barred while that plays out.
The path here started last November, when Amazon sued. Its complaint alleged that the startup had been quietly reaching into private shopping accounts by way of Comet, the browser it makes, and the agent embedded there, which is able to sign in and place orders for whoever is using it. Amazon’s filing raised security concerns and said Perplexity had brushed off repeated demands to stop. Perplexity called the suit baseless and characterised it as an effort to keep shoppers away from Comet, on the theory that agents, in its words, “don’t have eyeballs to see the pervasive advertising Amazon bombards its users with.”
The temporary bar came down in March, from a California federal court. Judge Maxine Chesney wrote that there was “strong evidence” that Perplexity had reached password-protected accounts with the permission of users but without authorisation from Amazon, and the startup was additionally directed to destroy copies of Amazon data it held. That order no longer stands.
The distinction the appeals court drew is worth slowing down on, because everything downstream follows from it. If the software is the actor, then an agent visiting a site without the operator’s blessing looks like an outside intruder, and terms of service written to exclude automated traffic apply squarely. If the human is the actor, an agent sits in roughly the same category as a browser, a password manager or a screen reader: instrumentation a person uses to reach a service they are already entitled to reach. The Ninth Circuit took the second view. That is the reasoning, not a detail of it.
Platforms that have been refusing agentic traffic on the strength of anti-bot clauses now have a weaker footing, at least in this circuit, and the qualifier matters. One appellate panel binds its own circuit and persuades elsewhere; it does not settle national law. A different circuit may reason its way to the opposite answer, which is precisely the sort of split that eventually reaches the Supreme Court. Nor does the ruling license anything an agent might do. It addresses access under one specific fraud statute, leaving contract claims, security obligations and data handling untouched.
Both companies are behaving as though this is unfinished. “We respectfully disagree with today’s decision on the preliminary injunction,” an Amazon spokesperson said, and went on to describe the company as still “confident in our case and are evaluating our next steps.” Perplexity’s Jesse Dwyer framed it as a user-rights fight, saying the company “will continue to fight for the right of internet users to choose whatever AI they want.”
Amazon’s position throughout has been that outside AI should identify itself and go through published interfaces, and it points to its own agentic products as the sanctioned route. Perplexity chief executive Aravind Srinivas has called that bullying and argued that an agent acting for a person should inherit that person’s permissions. The commercial relationship between the two makes the fight stranger than it looks: Perplexity buys AWS capacity under commitments running into the hundreds of millions, and Jeff Bezos is an investor in the startup.
The timing is hard to ignore. Elsewhere in today’s issue, Cloudflare is shipping identity and spending controls so agents can transact under supervision. One week is producing both a court answering whether an agent may act for you and infrastructure assuming it will.
Reported by The Decoder’s Maximilian Schreiner on 5 August 2026, citing Reuters.
