The Ninth Circuit Court of Appeals has effectively constrained the reach of the Computer Fraud and Abuse Act (CFAA) by ruling that AI agents function as tools rather than independent actors. In Amazon.com Services, LLC v. Perplexity AI, Inc., Judge Smith Jr. vacated a preliminary injunction that had blocked Perplexity’s Comet Browser AI assistant from interacting with Amazon’s platform. This decision establishes a critical, if narrow, framework for how courts will treat AI software in the context of digital access, prioritizing the distinction between human intent and automated execution.

At the heart of the court’s reasoning is the distinction between a person and a tool. The panel held that Perplexity did not access Amazon’s computers within the meaning of the CFAA or the California Comprehensive Computer Data Access and Fraud Act (CDAFA). The court emphasized that the CFAA contemplates access by a person, not a tool. As the opinion stated, However advanced [the AI Assistant] currently is, it is a tool, not a person for statutory purposes. Under this logic, it is the user — leveraging the AI assistant — who accesses the platform, rather than the software itself.

To illustrate this, the court employed what has become known as the Safari analogy. Just as no one would argue that Apple accesses a third-party server when a browser’s auto-fill feature populates user data, the court found that Perplexity’s AI assistant functions as a passive conduit. Because Perplexity’s servers do not directly communicate with Amazon’s infrastructure, the court distinguished this case from precedents like Facebook v. Power Ventures, where direct server-to-server interaction was a central factor.

The court’s decision was significantly shaped by an amicus brief filed by the Electronic Frontier Foundation (EFF), which was joined by organizations including Mozilla, the Alliance for Responsible Data Collection, Digital Medusa, and EleutherAI. The court explicitly credited this filing, noting that it articulates the nature of the system most clearly. The EFF successfully argued that AI intent should be ascribed to the user, and that the CFAA’s unauthorized access provisions cannot be stretched to cover software tools without criminalizing a vast array of common, day-to-day digital activities.

This ruling serves as a follow-up to the oral arguments heard on June 11 in Seattle, which highlighted the tension between platform control and user-directed automation. By rejecting Amazon’s broad interpretation of the CFAA, the court signaled a clear reluctance to expand the statute’s reach. The judges cautioned that adopting Amazon’s theory could inadvertently expose individual users to criminal liability, a result the court was unwilling to facilitate through judicial interpretation.

However, the ruling is explicitly narrow and fact-specific. The court acknowledged that there is little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant. This creates an analytical edge that builders must navigate carefully. While the decision stabilizes the current ecosystem for shopping assistants and browser-based agents, it leaves a structural liability gap for future autonomous agents that operate independently of direct user input.

For AI agent builders, the ruling clarifies that user-directed agents — those where the software acts as a clear extension of the user’s intent — now enjoy a degree of legal certainty, allowing developers to argue that their software is a tool, not an independent actor. Conversely, a legal gray zone remains for autonomous agents; when an agent’s actions are no longer traceable to a specific user’s intent, the protections afforded by this ruling may not apply.

Defining user direction will likely become the primary battleground in future litigation. Builders should prioritize documenting user intent and implementing robust control mechanisms to ensure their agents remain within the safe harbor established by this decision. While this ruling provides immediate relief for the current model of agentic commerce, it does not establish a comprehensive legal regime for AI. Instead, it leaves the industry to contend with the reality that as agents become more autonomous, the legal framework governing their access will face new, unresolved challenges.

Read the article at Forkast