Who Accesses Amazon When an Agent Shops?

A tool, not a person

The Electronic Frontier Foundation, which filed an amicus brief, notes the panel's useful refusal to invent AI "intent" for this statute. The assistant is a tool for statutory purposes, operated by users. Even when Perplexity receives account information and sends instructions, that did not amount to the control needed to treat the company as the accessor. Amazon may have other claims left. CFAA was the wrong hammer, and a dangerous one: stretching it here could expose users themselves to criminal theories for running software that shops on their behalf.

Amazon says it respectfully disagrees and is weighing next steps, including a possible rehearing. The underlying lawsuit continues in San Francisco. Perplexity's Jesse Dwyer framed the win as a fight for users to choose their AI. Beneath the press statements sits a quieter business quarrel. Amazon already fields its own helpers, including Buy For Me and Rufus, and has argued that third-party agents should stick to transparent APIs. Perplexity CEO Aravind Srinivas called the suit bullying. Jeff Bezos is among Perplexity's investors, and the startup remains a large AWS customer. None of that settles the legal question. It does explain the temperature.

Attribution is the product

The interim rule already rewrites platform strategy. If an agent acting on a user's click counts as the user for CFAA purposes, blanket bans dressed up as anti-hacking claims get harder to lock in at the preliminary stage. That is a win for open tooling. It is also a reminder that liability for harmful agent acts remains unsettled. The same attribution logic that frees Perplexity from "hacker" status can blur who answers when an agent buys the wrong thing, drains a wallet, or scrapes a policy Amazon meant to keep behind a login.

Britain's AISI report this week showed agents socially engineering real maintainers while chasing an eval score. The Ninth Circuit, in the same news cycle, treated a shopping agent as a user's instrument. Both stories are about agency. One asks what the model does when the goal is hard. The other asks whose name the law writes on the access log. For now, Amazon cannot keep Comet out by calling the middleman a burglar. The harder question, who owns the consequences when the agent is helpful and wrong, is still waiting for a case that is not about a shopping cart.