On August 4, the Ninth Circuit Court of Appeals vacated an injunction that had barred Perplexity's Comet browser assistant from logging into Amazon customers' password-protected accounts on their behalf. The opinion sat quietly for six weeks in law-firm client alerts. This week PYMNTS read it for what it is, the first appellate ruling in the United States on who is doing the accessing when an agent shops, and it deserves more attention from anyone building or accepting agent traffic than it has had.

The holding is narrow and the sentence is memorable. "It is the user who 'accesses' Amazon's computers, with the help of the Assistant to carry out specific acts," the court wrote. And then: "However advanced the Assistant currently is, it is a tool, not a person for statutory purposes."

The court did not decide whether agents may shop. It decided that when they do, the human at the keyboard is the one who did it. Every merchant's fraud model, every terms-of-service page, and every dispute process now has to absorb that.

What the court actually held

Amazon sued Perplexity under the Computer Fraud and Abuse Act, the 1986 federal anti-hacking statute, and California's equivalent, the Comprehensive Computer Data Access and Fraud Act. Its theory was that Perplexity was accessing Amazon's servers without authorization every time Comet's Assistant logged into a customer account, and on March 9 a district court in Northern California agreed enough to grant a preliminary injunction.

The appeals court took the injunction apart on the word "whoever." According to Cooley's analysis of the opinion, the panel found that "access means 'entering a computer system itself'" and that "the statute's use of 'whoever' contemplates access by a person, not a software tool." The decisive fact was architectural. The Assistant runs in the user's browser, on the user's machine, with the user's credentials. It sends screenshots to Perplexity's servers to get its next instruction, but "Perplexity itself does not directly communicate with Amazon's servers." The traffic Amazon objected to came from its own customer's computer.

So the user accessed Amazon, and the user was authorized, because it was their account. The California claim failed the same way. The case was remanded, and the court was careful about what it had not decided. It "expressly left open other claims, including breach of terms of service and contract- or tort-based theories," and it warned that "different facts regarding how the agent operated may have changed the outcome." An agent that talked to Amazon's servers directly from the developer's infrastructure, rather than through the user's browser, might land differently.

Why a hacking case is a payments case

Read as a cybersecurity ruling, this is a modest result about a 40-year-old statute. Read as a commerce ruling, it is the first time a court has answered the question I have been circling since June: when an agent buys something, who bought it?

The answer, for now, is the person who told it to. That is good news for the agent builders, who have been operating under the threat that every login on a user's behalf is a federal crime. It is a harder result for merchants than it looks, because it strips out the one remedy that did not require them to know anything about the agent. Under the CFAA theory, Amazon could treat unwanted agent traffic as intrusion and go after the developer. After this opinion, Cooley's advice to website operators is that the statute "may not effectively restrict AI agents accessing accounts where agent communications route through user computers," and that they should rely on terms of service and contract instead.

Terms of service bind the customer. Which means the merchant's recourse against an agent it does not want is now against the customer who sent it. That is the MM Liability Gap in a court's handwriting: the party with the least visibility into what the agent did is the one the law says did it.

I wrote last week that your best customer is now a bot, with Akamai putting AI bots at 47.9 percent of commerce traffic, and that the merchant's problem is telling a buying agent from a scraping one. This ruling raises the price of getting that wrong in both directions. Block a buying agent and you have blocked a customer who, in the court's eyes, was personally at your door. Admit a scraping agent and your intrusion claim against whoever built it just got weaker, because it came through a real person's browser.

The architecture is now the law

The most useful sentence in the opinion for anyone building an agent is the caveat. Different facts about how the agent operated could change the result. The court drew a line between an agent that acts inside the user's browser, with the user's session, and one that reaches the merchant from the developer's own servers. The first is the user acting. The second might be the developer.

That line already exists in the protocol layer, and it is worth saying which side each design lands on. A browser agent like Comet lives on the user side of the line, which may be part of why the two largest consumer AI companies shipped shopping agents without a checkout step this month: browsing on the user's behalf is now safe ground, and paying on the user's behalf is still unmapped. The Agentic Commerce Protocol behind ChatGPT's checkout passes a shared payment token from the platform to the merchant, which is closer to the developer side. The Universal Commerce Protocol's identity linking, which Worldline shipped a payment handler for on September 14, has the agent transact with an authenticated merchant identity that the user linked in advance, which is an attempt to sit on both sides at once. None of these protocols was designed with a CFAA opinion in mind. All of them now have one to be read against.

The pattern I would expect is that agent builders move toward the user's browser and the user's credentials, because that is where the court put the safe harbor, and merchants move toward stronger identity requirements at the front door, because that is where the court left them a remedy. Which is the argument for signed agent identity that I have made from the merchant side for months, now made from the bench. If the merchant is going to be told that the agent is the customer, the merchant is entitled to know which customer.

What to watch

Three things follow. First, whether Amazon pursues the contract and terms-of-service theories the court left open on remand, because that is the case that will decide whether a merchant can ban agents at all. Second, whether any agent developer changes its architecture in response, moving traffic off its own servers and into the user's browser to get under the holding. Third, whether the ruling shows up in the next round of protocol specs as a reason to put a verifiable, revocable user mandate in front of every agent action, since the court has now said the user owns the action either way.

The opinion is preliminary, fact-bound, and limited to two statutes. It is also the first time a federal court has looked at an agent at a checkout and said, in effect, that is a person's hand on the mouse. The infrastructure has been ahead of the demand for a year. It turns out it was also ahead of the law, and the law has started catching up by deciding that the agent was never there.

Sources

If the law says the agent was your hand on the mouse, and the merchant cannot see your hand, whose signature is on the receipt?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.