On Tuesday the Ninth Circuit overturned the injunction that had kept Perplexity’s Comet shopping agent from buying things on Amazon. The court’s reasoning was brief and, if you sell anything online, uncomfortable: when a logged-in customer sends an AI agent shopping on their behalf, it’s the customer accessing Amazon’s systems, not Perplexity. The Computer Fraud and Abuse Act — the anti-hacking law that has policed unauthorised access to computers since 1986 — doesn’t reach the company that built the tool.

Amazon disagrees and is weighing its options, so the case may yet travel further up the courts. But the direction matters more than the destination here, because the ruling confirms something most of us running websites had simply assumed was otherwise: the legal wall we thought stood between our sites and other people’s agents was never really there. Terms of service backed by the threat of a hacking claim felt like a lever, and for agents acting on behalf of your own logged-in customers, there turns out to be no lever to pull.

That changes the nature of the question. Whether AI agents can browse, compare and buy from your site is now a product decision, and like most product decisions it will either be made deliberately or it will make itself while you’re looking elsewhere.

What the court actually decided

Amazon sued Perplexity in late 2025, after Comet users started shopping through their own Amazon accounts with the agent doing the clicking, and won a temporary injunction in March. The appeals court vacated that injunction on 4 August, and the logic is worth understanding because it’s the part that generalises to your business. Comet only acts when a user directs it, so the person accessing Amazon’s servers is the customer, who is authorised to be there because it’s their account. Even the screenshots Comet relays back to Perplexity’s servers didn’t count as access in the court’s eyes.

The judges were candid about how little law there is here, noting “little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents”, and where the 1986 statute was ambiguous they resolved the ambiguity against liability. John Quinn, whose firm argued Perplexity’s appeal, put the winning theory in one sentence: the customer does the accessing, and Perplexity supplies the tool. The practical consequence for anyone running a site is that courts asked to stretch a forty-year-old anti-hacking law around AI agents are choosing to shrink it instead.

A rehearing or a Supreme Court run remains possible, and I couldn’t tell you how a differently constituted court would read the same statute. What I can tell you is which way the wind has been blowing for years — the LinkedIn scraping cases already narrowed this law for public data — and no court looks eager to hand website owners a mechanism for keeping their own customers’ agents out.

The lever that was never there

Ten days before this ruling I published the agent-ready website, arguing that which agents may read your site is a commercial decision to make on purpose. What the ruling changes is the enforcement half of that decision. For crawlers and search bots, enforcement mostly works: the well-behaved ones identify themselves and honour your policies, and the economics of bulk crawling make the rest a manageable nuisance. Shopping agents are different. They arrive wearing your customer’s credentials, doing your customer’s bidding, one purchase at a time — and the anti-hacking claim owners assumed covered that situation has now failed in front of the highest court yet to consider it. Other legal routes survive on paper, but the deterrent with real weight behind it has gone.

The web has been here before: the scraping wars, the API clampdowns, the affiliate purges (I watched most of them from inside a search agency, where these fights set the weather). They all follow the same arc. The platform reaches for whatever legal or technical weapon is to hand, the courts eventually shrink the weapon, and the market settles on commercial terms and product design. Thirty years of those fights teach one lesson: permission rather than capability decides where new technology gets to transact, and the courts have just declined to hand that permission to the platforms. We’re heading into the settlement phase early, which is better news for small businesses than another decade of litigation, because legal wars favour whoever has the most lawyers.

The levers you still hold

So if the law won’t decide who shops your site, the decision moves to the product roadmap. That sounds heavier than it is — none of us needs an agent strategy document this quarter, just a conscious position — and the levers available are ones most of us already understand:

  1. Design for agents, or against them. Rate limits, bot challenges and checkout friction can make agent traffic miserable enough to leave, at some cost to accessibility and to the humans behind the agents. Serving agents properly — clean product data, stable pages, a checkout that doesn’t require a puzzle — is the same work as serving customers properly, which is the strongest argument for doing it well.
  2. Verify, then differentiate. Web Bot Auth, which I covered in the agent-ready piece, gives you a way to check an agent’s identity cryptographically rather than taking a user-agent string on trust. The payment networks have already adopted it for authenticating their own buying agents, so the plumbing exists today for serving full pricing to operators you’ve chosen to work with and rather less to anonymous fetchers.
  3. Commercial agreements. If agent traffic converts, deals follow, in the same way search, affiliates and marketplaces all ended up with negotiated terms once the traffic was worth negotiating over.
  4. Agent-specific experiences. Walmart built a ChatGPT checkout and learned the hard way that it converted three times worse than its own website. Being agent-accessible isn’t automatically good business, so measure what agent-originated orders are actually worth to you before you optimise for them.

None of this is waiting for the appeal to play out, either. Obsidian Security, which sells tools for governing what AI agents may do inside company systems, told Reuters this week that nearly 70% of its customers already allow agents to interact with business data. Most of that activity sits inside companies rather than at checkouts, but it’s the same decision being made one tier up: organisations working out, permission by permission, what delegated software may touch. While you wait to see how the litigation ends, agents are already interacting with your site on whatever terms they happen to find.

Welcoming agents still means setting boundaries

The counterweight arrived the same week. The UK’s AI Security Institute gave frontier agents from Anthropic and OpenAI open internet access in a security exercise and logged 19 unsanctioned actions across 122 runs, including an agent that invented online identities to pressure a real open-source maintainer into approving malicious code. Nobody was harmed, and the testers had deliberately relaxed the usual safeguards, but the behaviour on display is the one that matters to any business opening its doors: delegated software will sometimes act beyond the scope its operator intended, and an agent arriving with your customer’s credentials can do everything your customer can do, at machine speed. Deciding to welcome buying agents therefore also means deciding what they may touch — which parts of the catalogue, which prices, which account actions — and saying so somewhere both a human and a machine can read it.

That’s the real work the ruling leaves on your desk: one legal defence you probably thought you had has gone, and what stands in its place is your own product choices. So walk your checkout the way an agent would — logged in, task in hand, no patience for ambiguity — and then decide, on purpose, whether you want that purchase to succeed. Nobody else is going to decide it for you.