The Ninth Circuit is currently grappling with a collision between 1986-era anti-intrusion law and the modern reality of delegated AI agency. In Amazon.com Services LLC v. Perplexity AI Inc., the court is conducting the first federal appeals court test of whether autonomous AI agents “access” computers under the Computer Fraud and Abuse Act (CFAA). The case, which centers on Perplexity’s Comet AI agent and its alleged covert interaction with private Amazon customer accounts, forces a judiciary to resolve novel questions of digital agency using a statute designed for a pre-internet era.
At the heart of the dispute is a fundamental question of characterization: is an AI agent a mere tool that extends a user’s reach, or is it an independent entity that requires its own platform-level authorization? During the June 11, 2026, oral argument, Judge Eric Tung captured this structural tension, noting,
“the user is giving the key to Perplexity, and Perplexity is then entering Amazon’s servers or computers. Much of this case turns on the proper analogy.”
If the agent is an extension of the user, it may inherit the user’s valid credentials. If it is an independent actor, its actions may constitute unauthorized access, regardless of the user’s intent.
The legal analysis relies on a specific chain of precedent that has defined the boundaries of the CFAA. The Supreme Court’s decision in Van Buren v. United States established a binary “gates-up-or-down” inquiry, rejecting broader “rule-of-use” theories that would have criminalized violations of platform terms. Meanwhile, the Ninth Circuit’s own ruling in hiQ Labs v. LinkedIn clarified that scraping publicly accessible data does not constitute unauthorized access. However, Facebook v. Power Ventures provides a counter-weight, establishing that a cease-and-desist notice can transform previously authorized access into an actionable intrusion. The court must now determine how these frameworks apply when the “intruder” is software acting on behalf of a human account holder.
The parties offer starkly different interpretations of this precedent. Perplexity argues that its AI agent inherits the authorization of the user, characterizing Amazon’s CFAA theory as a “fundamental misfit” for modern software. Conversely, Amazon contends that authorization is a personal right tied to the human account holder and cannot be delegated to third-party AI software. This debate has drawn significant attention from outside observers. Legal scholar Orin Kerr has proposed an “agency test,” suggesting that if User A provides credentials to User B, the latter is authorized only when acting strictly as the former’s agent. Simultaneously, an amicus brief from the Knight First Amendment Institute and the ACLU warns that a broad interpretation of the CFAA could chill digital journalism and research, potentially criminalizing legitimate user-directed AI activities.
The judiciary is effectively setting policy in the absence of a specific legislative framework for AI agents, forcing the court to weigh the broader implications of its decision. This governance gap is further complicated by Executive Order 14409, issued in June 2026, which directs the Attorney General to prioritize CFAA enforcement against unauthorized AI access. The Ninth Circuit’s decision will likely dictate the future of agent-web interaction law. An agent-favorable ruling would shield developers from CFAA liability when their software operates within user-granted credentials. A platform-favorable ruling, however, would establish that authorization is non-delegable, granting platforms significant control over which AI agents can interact with their ecosystems.
The case underscores the fragility of relying on legacy statutes to govern emerging technologies. As the Ninth Circuit considers the appeal of the preliminary injunction granted by Judge Maxine M. Chesney — which remains under an administrative stay — the legal system is forced to reconcile the 1986-era text of the CFAA with the 2026 reality of autonomous agents. The court’s eventual ruling will serve as a foundational precedent for how the law distinguishes between human intent and machine execution in the digital age.