You told your shopping agent yes. Amazon wants a court to say no.

You hand a shopping agent your Amazon login and tell it to do the boring part: reorder the coffee, watch for the price to drop, check out when it hits your number. You gave it permission. A federal appeals court is now weighing whether your permission was ever yours to give.

Amazon already won a court order in March that barred Perplexity’s Comet agent from shopping on Amazon with people’s own logins.¹ A three-judge panel of the Ninth Circuit heard Perplexity’s appeal on June 11 and left without ruling.² However it lands, the decision will write the first real rule for a plain question: can an agent you hire act for you on the sites you already use?

The short version: this fight turns entirely on which of two permissions counts; whether Comet is any good never comes up. Amazon’s position is that a site can refuse an automated agent even when you, the account holder, invited it in. Perplexity’s is that an agent following your instruction is just you, using a different browser. Until the Ninth Circuit rules, treat any “shop for me” agent as blockable at any moment: keep it on a card you can cancel, expect a refusal partway through checkout, and do not wire it into anything you could not redo by hand.

Editor’s note, ruling pending: The Ninth Circuit heard argument on June 11, 2026 and has not decided. This piece covers the case and the stakes, not the outcome. We will update it the day the decision lands.

For you if you use, or are tempted by, an agent that logs into sites and acts for you: shopping, booking, paying bills. Skip it if your AI only drafts and chats and never touches your accounts. This one will not reach you.

Amazon says a locked door beats your invitation

Amazon’s complaint sidesteps theft and damage entirely. Its claim is narrower and stranger: Comet came in without Amazon’s permission, even though it had yours.

Amazon sued Perplexity in November 2025, after an October cease-and-desist demanding the company stop disguising Comet as an ordinary Chrome browser instead of identifying it as an AI agent.¹ The legal hook is the Computer Fraud and Abuse Act, the federal anti-hacking law, plus its California counterpart. In March, U.S. District Judge Maxine Chesney granted a preliminary injunction (a court order that holds before any full trial) after finding Amazon had “strong evidence” that Comet accessed user accounts “with the Amazon user’s permission, but without authorization by Amazon.”¹

Read that finding twice, because it is the whole case. The court treated your say-so and Amazon’s say-so as two separate locks. You can open one. Only Amazon can open the other.³

That order is not in force today. In mid-March the Ninth Circuit granted a temporary administrative stay while it weighs Perplexity’s request for a longer pause during the appeal, so Comet is not blocked right now; the open question is whether the block comes back.⁴

A 1986 hacking law is deciding who gets to shop for you

Your account is your key. The case is whether Amazon can still turn your agent away at the door.

The statute doing the work here was written in 1986 to punish breaking into computers.² Pointing a hacking law at a shopping errand you asked for is exactly the stretch the appeals judges have to rule on. One member of the panel, District Judge John Hinderaker (a trial judge temporarily filling an appellate seat), said it plainly at argument: the case is hard “in part because we are dealing with a statute from 1986. It’s not really built for these circumstances.”²

Whether “without authorization” means “without the user’s permission” or “without the platform’s permission” is the hinge the whole agent economy now swings on.

Both sides have a straight-faced case

Strip out the branding and each side is defending something real.

Amazon’s case	Perplexity’s case
It is our infrastructure; we set the terms of automated access, the same way we block scrapers and bots.	Comet is a browser; the person logging in is the one accessing Amazon, not us.
An undisclosed agent disguised as Chrome is unauthorized access, full stop.	”No one would say Apple accessed the website simply because a Safari user navigated there.”2
Automation against our systems on a user’s say-so strips our control over our own site.	A site should not use a criminal hacking law to block competition its own customers asked for.

Perplexity’s lawyer, Chris Michel of Quinn Emanuel, made the competition point at argument: Amazon is stretching a criminal statute because it “wanted its own customers to access its website its preferred way.”² Amazon’s answer is that “its preferred way” marks the difference between a site the company can run and a site anyone can automate through.

Both can be true. That is what makes it a real case.

What the judges kept poking at, and what it does not tell us

At the June 11 argument, Hinderaker asked the question with no clean answer yet: “Does an AI agent ever have intent?”² The hacking law is built around a person knowingly exceeding their access. An agent does not “know” anything; it does what its user set it to do. The panel, Circuit Judges Milan Smith and Eric Tung with Hinderaker sitting by designation, submitted the case with no ruling and no timeline.²

A hard question at oral argument does not preview the outcome. Judges probe the weak spot of the side they agree with as often as the side they oppose. Read the questions as a map of what is genuinely unsettled.

No one, us included, knows how this comes out. What follows is a guide to reading the ruling when it lands.

What to watch when the ruling lands

Three broad directions, and what each would mean for you:

• The injunction is restored (Amazon’s reading holds). A site could use the hacking law to block agents its own users authorized. Expect more retailers to draw a hard line, and expect “shop for me” agents to quietly lose access to the sites that object. The agent still works; the store just says no.
• The injunction stays lifted (Perplexity’s reading holds). An agent acting on your instruction gets treated more like you holding a new kind of tool. It gets harder for a site to turn your agent away with a hacking law, though terms of service, contracts, and ad rules are separate fights this would not end.
• A narrow ruling. The court could decide on the disguise (Comet masking as Chrome) rather than the big agent question, and leave “can a site block an agent you authorized” open for the next case. That is the outcome that changes the least and settles the least.

Whichever lands, the reliability lesson does not move: an agent acting for you can be refused, paused, or redirected by a party that is not you. That risk rides along with hiring any software to act on sites you do not control, Comet or otherwise. The same tension shows up in whose interests your shopping agent actually serves and what a browser agent can do once it holds your logins.

What to do while three judges decide

• Keep agents on a leash you can pull. A virtual or cancelable card, a spending cap, and no saved payment method the agent can reuse unattended.
• Expect a refusal partway through. Treat a mid-checkout block as a normal outcome and confirm the order actually went through before you count it done.
• Do not automate the irreversible. If a step cannot be undone by hand in a minute, do not let an agent take it alone. The same caution that guards you against a calendar invite that hijacks your assistant applies here.
• Watch this case, not the hype. The appeal is No. 26-1444 in the Ninth Circuit, on top of district case No. 3:25-cv-09514.⁵ That is the docket that sets the rule.

The headline will say who won. The thing worth keeping is quieter: the moment you let an agent act for you, a third party you never hired gets a vote on whether it can. Designing for that (a refusal you expected, a cap you set, a step you kept for yourself) is the whole game. It is the same discipline our research desk applies to agents in production, in what it takes to run reliable AI agents.

Footnotes

1. CNBC, “Amazon wins court order to block Perplexity’s AI shopping agent.” The November 2025 suit, the October cease-and-desist over Comet disguising itself as Chrome, the March 9, 2026 preliminary injunction from U.S. District Judge Maxine Chesney under the Computer Fraud and Abuse Act, and the “with the Amazon user’s permission, but without authorization by Amazon” finding: https://www.cnbc.com/2026/03/10/amazon-wins-court-order-to-block-perplexitys-ai-shopping-agent.html ↩ ↩² ↩³

2. Courthouse News Service, “Perplexity AI asks Ninth Circuit to allow shopping tool on Amazon.” The June 11, 2026 oral argument, the panel (Circuit Judges Milan Smith and Eric Tung, with District Judge John Hinderaker sitting by designation), the statute’s 1986 origin, Hinderaker’s “statute from 1986 … not really built for these circumstances” and “Does an AI agent ever have intent?” questions, Perplexity counsel Chris Michel’s browser and competition arguments, and the case being submitted with no ruling: https://www.courthousenews.com/perplexity-ai-asks-ninth-circuit-to-allow-shopping-tool-on-amazon/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. Jones Day, “Authorized by the User, Blocked by the Platform: Testing the Legal Limits of AI Agents.” The user-authorization-versus-platform-authorization split at the center of the claim, and that this is an early judicial test of computer-access law applied to agentic AI: https://www.jonesday.com/en/insights/2026/05/authorized-by-the-user-blocked-by-the-platform-testing-the-legal-limits-of-ai-agents ↩

4. CyberScoop, “Appeals court temporarily pauses order blocking Perplexity’s AI shopping agent on Amazon.” The Ninth Circuit’s temporary administrative stay of the injunction, granted in mid-March 2026, while it considers Perplexity’s request for a longer pause during the appeal: https://cyberscoop.com/perplexity-comet-ai-shopping-agent-amazon-lawsuit-ninth-circuit-stay/ ↩

5. CourtListener, “Amazon.com Services LLC v. Perplexity AI, Inc.” District docket No. 3:25-cv-09514 (N.D. Cal.): https://www.courtlistener.com/docket/71874820/amazoncom-services-llc-v-perplexity-ai-inc/ ↩