Ninth Circuit Rules on AI Agent ‘Access’ to Third-Party Websites Under CFAA

On August 4, 2026, the US Court of Appeals for the Ninth Circuit vacated a preliminary injunction that had barred Perplexity’s AI agent from accessing Amazon.com on customers’ behalf, holding that Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) and California Comprehensive Computer Data Access and Fraud Act (CDAFA) claims against Perplexity. Reversing the district court, the panel explained that when a user tasks a Perplexity agent with taking actions on the user’s behalf on Amazon.com, it is “the user who ‘accessed’ Amazon’s computers,” not Perplexity. The decision is significant for both sides of the agentic AI ecosystem: It potentially offers AI developers a measure of protection from CFAA/CDAFA claims arising from agents acting at a user’s direction, while signaling to website operators that these anti-hacking statutes may not be an effective tool for policing agent access – though other legal theories, such as breach of terms of service, may remain available.

Two important limits temper the decision for both audiences. First, the ruling addresses only CFAA and CDAFA theories of liability and expressly leaves open other claims, including breach of terms of service and contract- or tort-based theories. Second, the panel made clear that the inquiry is fact-specific, noting the possibility that other AI agents with greater autonomy or more direct communication with a website’s servers could still give rise to CFAA and CDAFA liability. Because this appeal arose from a preliminary injunction, the panel’s findings reflect a likelihood-of-success assessment on the current record, not a final merits ruling.

Background

Amazon sued Perplexity in the US District Couty Northern District of California, alleging that Perplexity’s agentic browser feature, the “Assistant” (part of its Comet browser), accessed Amazon users’ password-protected Amazon accounts to browse and purchase products – at users’ direction. Amazon alleged that Assistant did so without identifying itself to Amazon as an AI agent and in violation of Amazon’s terms of service. Amazon claimed this conduct violated the federal CFAA and CDAFA. On March 9, 2026, the district court granted Amazon’s preliminary injunction, finding Amazon was likely to succeed on the merits because Perplexity’s access was not authorized by Amazon, regardless of whether the Amazon users had permitted Assistant to access their own Amazon accounts. Perplexity appealed.

The Ninth Circuit’s decision

On August 4, 2026, a Ninth Circuit panel vacated the injunction and remanded the case for further proceedings.

The panel’s decision turned on the threshold question of computer “access” under the CFAA. To prevail on a CFAA claim, a plaintiff must show that the defendant:

1. Intentionally accessed a computer
2. Without authorization or in excess of authorized access
3. Thereby obtaining information
4. From a protected computer
5. Causing at least $5,000 in aggregate loss in a one-year period

The court found that “access” means “entering a computer system itself,” and the statute’s use of “whoever” contemplates access by a person, not a software tool. As a result, “it was the user who ‘accessed’ Amazon’s computers, with the help of Perplexity’s AI agent, the ‘Assistant,’ to carry out specific acts on Amazon.com.” Because the user, not Perplexity, accessed Amazon’s servers, the court found Amazon was unlikely to prevail on a CFAA claim against Perplexity.

To reach this holding, the court examined how Assistant works. When a user directs the Assistant to shop on Amazon, the Assistant takes screenshots of the browser view on the user’s own machine and sends those screenshots to Perplexity’s servers, which then send back instructions on how to navigate Amazon.com to the user’s computer. Critically, “Perplexity itself does not directly communicate with Amazon’s servers,” as communications are routed through the user’s computer. The court distinguished this fact pattern from those in cases such as Facebook, Inc. v. Power Ventures, Inc., where the defendant’s own systems caused messages to be transmitted directly on Facebook’s platform, without first passing through a user’s machine.

The CDAFA was likely to fail for the same reason. Although the CDAFA defines “access” more broadly than the CFAA, the panel held that the statute still focuses on the person accessing or causing access. Because the user, not Perplexity, accessed Amazon’s systems, Amazon’s CDAFA claim was also unlikely to succeed.

Finally, the court also held that the equitable factors underlying a preliminary injunction favored Perplexity, as Amazon’s evidence of irreparable harm – claims that the Assistant might not select the best price or product for a user – was comparatively weak and abstract, and that Amazon’s cybersecurity concerns were unconvincing.

Remaining liability risk

The court made clear that different facts regarding how the agent operated may have changed the outcome. For example, if an AI company exercises greater control over its agent or if the company’s servers communicated directly with the defendant’s servers, that may yet support a finding that the company itself “accessed” a website’s servers.

The court also expressly narrowed the holding to the CFAA and CDAFA contexts. The court left open the possibility that the same conduct could be the basis for other types of claims, such as claims sounding in tort or contract.

Practical takeaways for website operators

Websites seeking to restrict AI agents from accessing accounts or taking actions on a user’s behalf should not assume that the CFAA or similar state anti-hacking statutes will provide an effective remedy, at least where the AI company’s own systems do not directly communicate with the website’s servers. Such websites may have to turn to other theories of liability, such as enforcing terms of service.

Practical takeaways for AI agent developers

Makers of agentic AI tools should take some comfort from the Ninth Circuit’s finding that a user directing an AI agent – rather than the AI company itself – is the one who “accesses” a third-party website for CFAA and CDAFA purposes, at least where communications with the third-party website’s servers are routed through the user’s computer. This finding puts new emphasis on how the AI agent communicates; agents that do not rely on the user’s computer as a relay will pose greater risk. AI developers should not treat this decision as foreclosing liability under other legal theories, including contract-based claims arising from a website’s terms of service.