Amazon sued Perplexity in November over the Comet browser’s AI Assistant, which logs into a user’s Amazon account and shops on their behalf. On March 9, Senior U.S. District Judge Maxine Chesney granted a preliminary injunction, finding Amazon likely to succeed on claims under the Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act. Perplexity, valued at $21 billion earlier this year, was blocked from touching Amazon’s logged-in account pages.
On Tuesday a three-judge Ninth Circuit panel vacated that injunction and sent the case back. In 21 pages, the panel held the district court abused its discretion, because Amazon is unlikely to win on the single word the whole case turns on: access.
“Our focus is thus to ask whether Perplexity uses a tool (the Assistant) to ‘access’ Amazon’s computers,” wrote Circuit Judge Milan Smith Jr. “On the facts before us, we answer no. It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.” The panel dealt with Amazon’s strongest technical fact head-on: “Perplexity may receive screenshots of the user’s browser and may communicate instructions to the Assistant. But those activities, by themselves, do not mean that Perplexity has ‘accessed’ (gained entry) to Amazon’s servers.” The CDAFA claim died on the same logic — broader statute, same question, same answer.
The precedent the court says isn’t one
The panel was careful. It limited the holding to “‘access’ as contemplated by the CFAA and as applied to the Assistant’s interactions with Amazon.com on the record before us,” and said explicitly that it was not establishing “a new legal regime governing agentic AI.” It reached for the rule of lenity — the canon that construes an ambiguous criminal statute against liability — and noted there is little to no existing caselaw on how to assign responsibility for AI agents.
Everything else fell with the merits. “Because Amazon has failed to show a likelihood of success on the merits of its claims, its arguments regarding the harm to Perplexity from an injunction fall flat,” Smith wrote, reversing the lower court on irreparable harm, the balance of equities and the public interest. Smith, a George W. Bush appointee, was joined by Circuit Judge Eric Tung and District Judge John Hinderaker, both Trump appointees, the latter sitting by designation from Arizona.
Our take: Narrow on paper, enormous in practice. Amazon’s theory was that the company shipping the agent is the one breaking in — a theory that makes every agentic product a standing felony risk, because the CFAA is a criminal statute with a civil hook attached. The panel moved the actor from the vendor to the human who typed the instruction. That is the difference between a business model and an indictment. Platforms that want agents out are not defenseless; they still have contract, technical blocks and identification requirements, which is what Amazon has been asking for all along. What they no longer have, in the Ninth Circuit, is the hacking statute as a shortcut. Agent companies have spent a year arguing about what their agents should be allowed to touch. This is the first appellate answer, and it starts from the assumption that the agent is a tool, not a trespasser.
What to watch
- Amazon’s next filing. It can seek rehearing en banc or press the merits back before Chesney. The company has said it disagrees with the ruling and is weighing options.
- The rest of the complaint. This vacated a preliminary injunction on one prong. The underlying suit — and Amazon’s non-CFAA theories — survives.
- Identification requirements. Amazon’s stated position is that agents must transparently identify themselves. Expect that to migrate from litigation into terms of service and technical gates across large platforms.
- Citation velocity. The panel disclaimed making agentic-AI law. Watch how fast it shows up in briefs anyway — every dispute over what an agent may do on someone else’s infrastructure now has a paragraph to quote.
The commercial stakes are the tell. Amazon just crossed $3 trillion partly on the strength of owning the checkout. An agent that comparison-shops across storefronts on the user’s behalf is a direct threat to that, and the CFAA was the fastest available tool for keeping it out. It just stopped working.