Agentic Browsing and the CFAA: The Ninth Circuit's Amazon v. Perplexity Ruling — and the Post-Legal Blockade of Agents

Agentic Browsing and the CFAA: The Ninth Circuit's Amazon v. Perplexity Ruling — and the Post-Legal Blockade of Agents

Revised 2026-09-23: adds the Ninth Circuit's Sept 10 denial of en banc rehearing, Amazon's Sept 20 Conditions-of-Use blockade of Meta's Muse agent, the robots.txt forensics, and the market implication — an identification-and-permission regime is replacing law as the gate on agentic data access.

The legal arc, all dates 2026:

• March: Amazon wins a preliminary injunction keeping Perplexity's Comet shopping agent out of the password-protected parts of amazon.com while the case runs.
• Aug 4: The Ninth Circuit vacates the injunction. Comet runs on the shopper's own machine, so the court starts from the fact that "Perplexity's servers never directly access Amazon's servers" (quoting a brief by the EFF and four other groups) — the shopper, not the vendor, is the one visiting the site.
• Sept 10: The court denies rehearing en banc; per Courthouse News (as relayed in the No Hacks writeup), "not one judge asked for a vote on it."
• Sept 20: Amazon blocks Meta's Muse shopping agent with a Conditions-of-Use interstitial shown to shoppers who sent Muse: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Amazon's three stated reasons: Meta never disclosed Muse would access the store, the agent "doesn't identify itself when it browses," and it "appears to capture and store customer credentials" — a claim Meta had preempted on launch day by publishing that credentials live in a per-user VM service (authd) with the agent working only from surrogate tokens exchanged at the network boundary by a component called Sentinel.

Why the usual controls couldn't stop Muse: Meta's crawler documentation lists five agents and Muse is not among them, so robots.txt had no name to refuse — and Muse drives "a real up-to-date Chromium based browser" inside a per-user cloud VM, where Meta says it "will appear as your activity." Amazon's own robots.txt (fetched Sept 22 by the author) shows how heavily the gated-source regime is already used: 101 user-agent blocks, 100 carrying Disallow: /, naming 99 distinct agents — GPTBot, CCBot, PerplexityBot, ClaudeBot, Google-Extended, GoogleAgent-Mariner and GoogleAgent-Shopping are refused everything.

The reserved question that keeps the legal story open, written into the Aug 4 opinion: "We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers." Muse — which runs on a cloud VM, not the shopper's device — is exactly the vendor-controlled fact pattern the ruling did not reach. And per GeekWire (as cited in the No Hacks piece), Meta signed a multibillion-dollar April 2026 deal to run agentic workloads on AWS Graviton; if Muse is among those workloads, "Amazon is blocking an agent that runs on hardware Amazon rents out."

Market-map implication (Destination vs. Backend: The Research-Tool Market Bifurcates — and Both Layers Converge on MCP): with the No Hacks author's summary — "in this circuit the anti-hacking law is mostly gone as a tool against an agent a person sent"¹ — destinations fall back on ToS plus unilateral blocking, and Amazon's stated demand that third-party agents "should operate openly and respect service provider decisions about whether or not to participate" is effectively a proposal for an agent identification-and-permission regime. For research-agent vendors that leaves two compliant data paths: (1) operate on the user's own device/session — the Comet architecture that won in court — or (2) license sources as MCP backends² (Parallel: Deep Research Sold as Per-Request Backend Infrastructure — with Audit-Grade Provenance and Shapley-Value Payouts to Publishers, Institutional MCP Financial Data Servers: FactSet, S&P Global, and PitchBook Unbundle). A watch is registered for an agent-identification/authentication standard going live at a major destination.