The Bot Is the User Only While It Runs on the User's Machine
Nine days after a federal judge ordered Perplexity's shopping agent to stay out of Amazon accounts, the agent moved. Not off Amazon. Off the customer's computer. That is the claim at the center of the amended complaint Amazon filed on September 21. In August the Ninth Circuit let the agent back in with one sentence: it is the user who accesses Amazon, not Perplexity. I called that the bot becoming the user. The sentence rests on a fact about architecture. The agent ran inside a browser on the user's own machine, so the user was the one at Amazon's door. Amazon now alleges that on iPhones, from March 18, the agent ran in Perplexity's cloud, carrying the customer's login cookie and knocking on its own. Which computer runs the agent decides whose access it is.
What the appeals court actually held
The panel described Comet as a browser "running locally on a user's machine". The assistant takes screenshots of the page, sends them to Perplexity's servers, and gets back instructions on what to click. The hacking statute punishes whoever accesses a protected computer, and a tool is not a whoever. "It is the user who 'accesses' Amazon's computers." Then a caveat that matters now. The court did not decide "whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers". The ruling covered the preliminary injunction only.
The different record
Amazon's amended complaint is that record. Comet for iOS launched on March 18, nine days after the injunction. On a phone, the complaint alleges, switching on agent mode copies the user's Amazon login cookie to Perplexity's cloud servers. Those servers run a virtual browser, fetch Amazon's pages directly and stream screenshots back to the phone. "No user device touches Amazon's servers." Amazon says its engineers watched that traffic daily until at least May 11, and that the sessions never identified themselves as Comet. It quotes Perplexity's own notice to iPhone users: "This request will be handled by a virtual cloud browser."
Perplexity's opening brief on April 1, two weeks after the iOS launch, told the Ninth Circuit that "no Perplexity computer ever has direct access to an Amazon computer". On May 11, after a letter from Amazon's lawyers, Perplexity said it had "temporarily disabled the assistant feature on Amazon.com in Comet for iOS". These are allegations, and Perplexity's motion to dismiss, filed September 11, says the appeal settled the point: "This case asks whether a dominant online platform can turn a criminal hacking statute into a tool for policing how its customers use the internet. The Ninth Circuit has answered with an unequivocal no." The hearing is set for November 20.
View data table
| Date | In court | On the wire |
|---|---|---|
| Nov 4, 2025 | Amazon sues Perplexity in San Francisco | |
| Mar 9, 2026 | Judge Chesney enjoins Comet from Amazon accounts | |
| Mar 18, 2026 | Comet for iOS ships; agent mode runs in “a virtual cloud browser” (Amazon’s complaint) | |
| Apr 1, 2026 | Perplexity’s appeal brief: “no Perplexity computer ever has direct access to an Amazon computer” | |
| May 11, 2026 | Perplexity “temporarily” disables the Amazon assistant on iOS (letter to Amazon) | |
| Aug 4, 2026 | Ninth Circuit: “It is the user who accesses”; injunction vacated | |
| Sep 8, 2026 | Meta launches Muse, a consumer agent | |
| Sep 11, 2026 | Perplexity moves to dismiss; hearing set for Nov 20 | |
| Sep 20, 2026 | Amazon blocks Muse: “unauthorized AI agent” | |
| Sep 21, 2026 | Amazon’s amended complaint: on iOS the agent “dispenses with the user’s computer altogether” | |
| Sep 23, 2026 | Amazon’s robots.txt names 99 crawlers and agents; each gets “Disallow: /” |
Power Ventures was an architecture
The case the panel distinguished was Facebook v. Power Ventures, the same court's 2016 decision. Power's users handed over their Facebook passwords, and Power's servers logged in. Comet was different, the panel said, because Perplexity's servers never touched Amazon. An agent on the customer's device inherits the customer's permission, because the customer is the one visiting. An agent on the vendor's servers with a copied cookie is Power's architecture with a cookie in place of a password.
If Amazon's description holds up, the law did not change between March and August. The deployment did, and it carried the agent across the line the court had just drawn. That choice is now an engineering decision with a legal consequence. Run on the device and be the user. Run in the cloud and be a visitor in your own right. A visitor in its own right needs a name.
Operate openly
Meta launched Muse, its consumer agent, on September 8. By the night of September 20, anyone asking Muse to shop on Amazon saw a notice: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use." Amazon's statement said such applications "should operate openly and respect service provider decisions about whether or not to participate".
A site's robots.txt is the public file that tells crawlers what they may fetch. Amazon's, read on September 23, names 99 crawlers and agents, from OpenAI, Google, Anthropic, Meta, Perplexity and Mistral, and gives each the same one-line answer: nothing. Last week I wrote that a bot's signature is the name on the invoice. Amazon has the names. The invoice so far reads zero, and an agent that arrives without a name gets a lawsuit instead of a price.
Grading August
In August I wrote that Amazon would open an official door for agents before this case reached a verdict. Seven weeks later the door is shut harder: Muse blocked, Google's and OpenAI's shopping agents in the file, a new complaint filed. The stance stays on the board. But the reasoning I gave for it has aged badly. I wrote that the agent executes on the customer's computer. Amazon says that stopped being true on a phone in March.
Here is the sharper position. The bot is the user only while it runs on the user's machine. The first official agent door on a major retail platform will admit cloud-hosted agents only under a signature and terms, and will treat agents on the customer's own device as the customer. I am wrong if the first such program admits anonymous cloud agents. I am also wrong if, by the end of 2027, no major retail platform has opened one and a court has settled where an agent may run instead.