The Court Just Ruled Your Agent Is You

Most of what this site argues rests on an assumption that was, until this month, legally untested: that when a person tells an assistant to go do something on a website, the thing arriving at your server is that person. Not a scraper wearing a costume. The person.

A federal appeals court has now said something close to that out loud. It is one circuit, it is procedural rather than final, and it is not legal advice. It is also the first serious signal about how the law is likely to treat the traffic you are about to start receiving a lot more of.

What happened

Amazon sued Perplexity over Comet, Perplexity's agentic browser, which could log into a user's Amazon account and complete purchases for them. Amazon's theory leaned on the Computer Fraud and Abuse Act — the anti-hacking statute that turns on whether access to a computer was "authorized." Amazon's position was that its terms prohibit automated purchasing, so an agent doing it exceeded authorized access. On March 10, 2026 a district court agreed enough to issue an order blocking the behavior.

On August 4, 2026 the Ninth Circuit vacated it. The reasoning that matters for everyone who is not Amazon or Perplexity: a user-directed agent is not a third party accessing the site. It is an instrument of the user, and the user already has authorization. If the customer may log in and buy a thing, the customer's agent logging in and buying that thing is not an unauthorized access — it is the same access, performed differently.

Vacatur of a preliminary order is not a final judgment on the merits, and the underlying dispute continues. But the framing is the important output. It relocates the question from "was this automated?" to "was this the customer?"

Why the distinction between agent types now carries legal weight

The single most common mistake in this whole area is treating all non-human traffic as one category. The ruling speaks to one of two very different things.

User-directed agents. ChatGPT-User, Claude-User, Perplexity-User, Google-Agent, and the agentic browsers. These fetch because a specific identified person asked for something right now. There is a human at the other end waiting on the result. One request, one intent, one beneficiary. This is the category the Ninth Circuit was talking about.

Bulk crawlers. GPTBot, ClaudeBot, CCBot. These fetch on the operator's schedule for the operator's purposes — corpus building, index construction — with no particular user waiting. No individual's access rights are being exercised. Nothing in the Comet decision says you cannot exclude these, and the whole body of crawler-permission machinery that has grown up around them remains intact.

If your robots.txt or your WAF collapses those two groups into one rule, you have made a policy decision you probably did not intend to make, in both directions. We wrote about how the OpenAI family in particular splits across those lines in what OAI-AdsBot means for your robots.txt.

The detection problem, which is worse than the legal one

Suppose you disagree with all of this and want to block user-directed agents anyway. In a growing share of cases, you cannot, because there is nothing to block against.

Agentic browsers are browsers. Comet is Chromium. Anthropic's and OpenAI's browser integrations run inside Chrome itself. The requests carry an ordinary Chrome user-agent string, real TLS fingerprints, real cookies, a real logged-in session, and a real screen. At the HTTP layer there is frequently no signal that distinguishes "the user clicked this" from "the user's agent clicked this on their behalf." The self-identifying agent user-agents — the -User suffixed ones above — are the honest, well-behaved end of the spectrum, and they are also the part that is shrinking as agent capability moves inside the browser people already have. That shift is the subject of Atlas is dead, agentic browsing isn't.

The practical consequence is uncomfortable but simple. A blocking strategy built on user-agent strings is enforceable only against agents that volunteer their identity. Its main effect is to penalize disclosure.

The read/act split is the useful idea here

Of everything above, this is the piece worth internalizing, because it is the part that generalizes past this case.

Reading is cheap, low-risk, and mostly upside — an agent that reads your documentation and cites you accurately is doing free distribution. Acting is where the risk lives: money moves, inventory changes, state mutates, and if the agent got the intent wrong you have a support ticket and possibly a chargeback.

Most sites have exactly one bot policy and it governs both, usually because it was written when the only non-human visitor worth thinking about was a search crawler. The sites that will handle the next few years well are the ones that write two policies: an open, generous read policy that maximizes the chance of being retrieved and cited accurately, and a deliberate act policy with authentication, confirmation steps, limits, and reversibility built into the paths where an agent can change something. Our interaction models material works through what the act side looks like in practice.

The rest of the legal picture

The Comet ruling did not arrive in a vacuum, and it is worth being precise about what the neighboring cases do and do not settle.

CNN v. Perplexity, filed May 28, 2026, is a copyright and misappropriation dispute about content use in answers. It is a different question from CFAA access authorization — what you may do with content you retrieved, not whether you were permitted to retrieve it.

Bartz v. Anthropic received final approval of a $1.5 billion settlement on July 20, 2026. A settlement, importantly, is not a precedent. It prices one company's exposure over training data acquisition; it does not establish a rule other courts must follow, and it says nothing about user-directed retrieval.

The 2025 Cloudflare/Perplexity stealth-crawling dispute — in which Cloudflare published research alleging Perplexity used undeclared user-agents to reach content that had blocked its declared ones — was never formally resolved. No court ruled, no regulator acted. It ended as a reputational fight, which is worth remembering as a preview of how many of these disputes actually end. We covered it in detail in the Perplexity-Cloudflare crawling controversy.

Put together: training-data acquisition is contested and expensive, content reuse in answers is unresolved and actively litigated, and user-directed access is — for now, in one circuit — treated as the user's own access.

Caveats, stated plainly

This is one Ninth Circuit decision vacating a preliminary order. It is not settled national law. Another circuit can reach the opposite conclusion and create a split. The underlying case can still produce a different final outcome. State computer-crime statutes, contract law, and consumer-protection rules all operate independently of the CFAA and may reach different results on the same facts. And nothing here is legal advice — if you are making a decision that depends on this, talk to a lawyer who can look at your specific situation.

What is safe to take away is directional rather than doctrinal: the legal system's first serious answer to "who is the agent" was "the user," and the technical system's answer — that agent traffic is arriving inside real, authenticated browser sessions you cannot separate anyway — points the same direction. Policy built on the assumption that automation is separable from the person is standing on ground that is moving under both feet at once.

References

• CNBC, "Amazon wins court order to block Perplexity's AI shopping agent", March 10, 2026
• Engadget, "Appeals court vacates the order blocking Perplexity's Comet from Amazon", August 4, 2026
• Cloudflare, "Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives", August 2025
• OpenAI, OpenAI crawler and user-agent documentation
• Anthropic, Claude bot and agent user-agents