Amazon v. Perplexity: what the Ninth Circuit’s ruling means for platforms deciding which agents to let in

Before banks started restricting AI agents in October 2026, the sharpest fight over agent access was in retail. Amazon sued Perplexity in November 2025 over Comet, Perplexity's AI browser, which could shop on Amazon for its users. In August 2026, a federal appeals court lifted the order that had stopped it.

The case is about shopping, but the question underneath it is the one every bank and platform now faces: when a customer sends an AI agent to act in their account, does the platform get a say? This post summarises the case and draws out what it does and does not decide. It is not legal advice.

The claims

Amazon alleged that Perplexity committed computer fraud by failing to disclose when Comet was shopping on a real person's behalf, and by refusing to stop when Amazon asked, Bloomberg Law reported. The claims were brought under the federal Computer Fraud and Abuse Act and California's computer data access law.

The injunction

In March 2026, a federal district court in San Francisco granted Amazon a preliminary injunction requiring Perplexity, for the time being, to stop using Comet to make purchases for shoppers on Amazon.com, per Bloomberg Law. The Ninth Circuit stayed that order while it heard the appeal.

The appeal

In early August, a three-judge panel of the Ninth Circuit vacated the injunction. According to Retail Insight Network's summary, the panel found that on the current record Perplexity itself did not access Amazon's systems: users access Amazon's website, and Perplexity's assistant operates as a tool following the user's instructions. Amazon was therefore unlikely to succeed on its computer-access claims, and the other factors, including the public interest, favoured Perplexity.

The court was careful to limit itself. Its ruling is confined to the factual record before it and “does not set broader legal principles regarding agentic AI”. The case went back to the district court for further proceedings, Northeast Times noted.

What it does not decide

• It is a ruling on a preliminary injunction, not on the merits. The lawsuit continues.
• It is about computer-access statutes. It says nothing about contract terms, consumer protection or banking regulation.
• It concerns a retail marketplace. A bank account, with its own rules on authorisation and security procedures, is a different setting.

What it does suggest

The key move in the panel's reasoning, as reported, is to treat the agent as the user's tool rather than as a separate party breaking in. That framing has a clear consequence for platforms: at least on a record like this one, computer-access law may not be a reliable way to keep user-directed agents out.

Banks seem to have reached the same conclusion by a different route. Their October 2026 responses lean on contract and engineering rather than litigation. Wells Fargo's new terms reserve the right to “limit, prohibit, prevent, suspend, or terminate access by any AI Agent” and to require customers to register agents (section 15(g)). The six-bank principles paper says service providers should keep the choice of which agentic services to support “based on safety, commercial sustainability and legal / regulatory grounds” (principle 4.2).

The disclosure thread

One part of Amazon's complaint deserves more attention than it got: that Comet did not disclose when it was acting for a real person. Disclosure is becoming the industry's default expectation. The six banks' first principle is that all parties should know “when an AI agent is helping to make or facilitate a transaction, and on whose behalf.” Cloudflare reports that major operators now cryptographically sign their agents' requests so sites can tell a real agent from an impersonator. The draft Personal Agent Protocol has agents sign in on the company's own page with scoped permissions.

Disclosure solves part of the problem: knowing that an agent is present. It does not solve the other part: knowing whether the person is.

What platforms should take from it

1. Assume agents will arrive, with the user's blessing. Courts may treat them as the user's tools. Plan for them rather than relying on keeping them out.
2. Decide by action, not by visitor. Browsing, searching and reading are low-risk whoever does them. Buying, paying, withdrawing and changing account security are not.
3. For the actions that matter, ask for a person. The platform cannot always control who visits. It can control what an action requires. Requiring that a person be in control at the moment of a sensitive action lets agents help with everything else.

That third point is where HEIP fits: one check, at the action, on whether a person is at the controls, so a platform can welcome agents without handing them the steps that should belong to people.