A Ninth Circuit ruling puts the AI agent in the user's seat

On 4 August 2026 a Ninth Circuit panel vacated the preliminary injunction that had stopped Perplexity's AI agent from acting on Amazon.com for Amazon customers. The panel held that the entity that "accessed" Amazon's computers was the user, not Perplexity. Cooley's case alert of 6 August 2026 sets out the reasoning and, just as usefully, the two limits on it.

The ruling matters beyond one shopping agent because it is a statement about where a person ends and the software acting for them begins. That boundary is what every site owner has been guessing at since agents started filling in forms.

What the court actually decided

Assistant, the agent inside Perplexity's Comet browser, took screenshots of the browser view on the user's own machine, sent them to Perplexity's servers, and received back instructions for navigating Amazon. Perplexity itself did not open a connection to Amazon's servers. On that architecture the panel reasoned that the CFAA's "whoever" contemplates a person, so "access" means the person entering the system, and the person here was the user who gave the instruction. The California CDAFA claim failed for the same reason.

The district court had gone the other way on 9 March 2026, finding Amazon likely to succeed because Perplexity's access was not authorised by Amazon regardless of what its users allowed. The Ninth Circuit reversed that and remanded the case.

What it changes for a site owner

The practical takeaway is narrow and useful: do not build a bot policy on an anti-hacking statute alone. The panel left contract and tort theories open, and said plainly that a different agent could come out differently.

• Terms of service remain the lever the opinion itself names.

• An agent that talks to your servers directly, without relaying through the user's machine, is closer to the fact pattern the court distinguished.

• Greater control by the AI company over its agent points the other way.

For a Form owner this is the part that lands. A Form's defences are not legal theories; they are the things that happen at the moment of a POST.

What a Form's bot controls should rest on

FormFlow offers a Turnstile challenge and a per-Form spam model trained from human Corrections. Turnstile is one provider's challenge, and it fails open: when the provider cannot be reached, a Submission is not blocked on that basis. The spam model weighs request evidence against a model the Form's own Corrections have shaped, and a Team prior can flag a Submission but never veto it.

None of that is a guarantee, and none of it is a statement about what is lawful. It is an argument against a single control. A Form that depends on one signal has one point of failure, whether that signal is a challenge, a user-agent check or a court case.

What this does not decide

This appeal came from a preliminary injunction. The panel assessed a likelihood of success on the current record and remanded the case. It did not hold a trial or reach a final merits ruling, and the injunction was vacated, not replaced with a judgment for either side.

The holding is confined to the CFAA and CDAFA. It does not make AI agents legal, does not bless agent access generally, does not decide contract or tort claims, and says nothing about robots.txt, terms of service or any other access policy a site might adopt.

Nor does it decide anything about FormFlow's controls, which are engineering choices rather than legal ones. Read the primary source rather than a summary. For the POST contract a Form enforces, read the API reference, and for the origin of that contract see the v1.0.0 Changelog entry.