AI Agents and the CFAA: The Agent Is a Tool, Not a Person

This post is informational and reflects the state of the law as of August 2026. For your situation, consult a licensed attorney.

When an AI agent takes an action on your behalf, who is the one “acting” in the eyes of the law? A federal appeals court just gave an early, consequential answer.

In amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), the Ninth Circuit vacated a preliminary injunction Amazon had won against Perplexity’s agentic web browser. Perplexity’s tool logs into a customer’s Amazon account, using the customer’s own credentials, and shops on the customer’s behalf. Amazon argued that was unauthorized “access” under the Computer Fraud and Abuse Act (CFAA) and its California analogue. The panel disagreed, and the reasoning is what matters.

”A tool, not a person”

The CFAA punishes “[w]hoever … intentionally accesses” a protected computer. The court read that literally: the statute “contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.” So the question is not whether the AI accessed Amazon; it is whether a person did, using the AI. On the facts, the panel held it was the user who accessed Amazon, with the agent carrying out specific tasks. Same result under California’s computer-fraud statute.

The practical effect: the injunction was vacated and the case remanded. This is not the last word (it is a preliminary-injunction ruling, and litigation continues), but it is a published appellate decision, and it will be cited.

Why this matters beyond scraping fights

Strip away the Amazon-versus-Perplexity commercial dispute and the holding speaks to a question every company deploying agentic AI is going to face: when the agent acts, the law is inclined to look through the tool to the person directing it. That cuts two ways.

If you deploy an agent, the conduct it performs on your instruction is likely to be treated as your conduct, not the vendor’s and not the tool’s. “The AI did it” is not shaping up to be a liability shield.
If you build an agent, this decision is helpful on the narrow CFAA “access” point, but it does not resolve the broader questions, contract, tort, and otherwise, about who answers for an autonomous system’s actions.

That is the same theme running through agentic-AI contracting: authority and responsibility track the human or company directing the tool, so define them deliberately rather than assuming the tool absorbs the risk. (For the contracting side, see the post on contracting with agentic AI vendors, and the firm’s AI Governance and Technology Transactions practices.)

If your business is deploying or building AI agents, talk to MB Legal about where the responsibility lands.

This post is informational and does not constitute legal advice. The cited decision is a preliminary-injunction ruling and the litigation is ongoing. For guidance on a specific situation, consult a licensed attorney.