Category: Regulation
In early 2026, a federal court issued an injunction against Perplexity AI's Comet browser following a dispute with Amazon over unauthorized system access. Perplexity's agent spoofed the Chrome browser's identity to bypass Amazon's access controls. Amazon sent five explicit warnings before taking legal action. The court found a likely violation of the Computer Fraud and Abuse Act and issued the injunction.
The legal principle the case established goes well beyond the dispute between these two companies.
The Core Holding
A user's authorization to access a platform does not transfer to an agent acting on that user's behalf. A human user who has an Amazon account and is authorized to access Amazon's systems cannot grant an AI agent blanket authorization to access those systems by virtue of their own credentials. The agent needs its own verified authorization, scoped specifically to what it is permitted to do, separate from the human principal's permissions.
This principle has immediate implications for the majority of enterprise agent deployments. Most agents are given access to systems by inheriting service account credentials, OAuth tokens, or API keys that were provisioned for broad access rather than for the specific scope of what any individual agent is permitted to do. In the Amazon v. Perplexity framework, every one of those deployments may be operating under a legally questionable authorization model if the agent accesses systems or data beyond what was specifically scoped for its purpose.
The Identity Spoofing Element
Perplexity's agent spoofed Chrome's identity. This is the element that made the CFAA violation most clear. But the spoofing was only necessary because the agent lacked its own verified identity that Amazon would recognize as authorized. An agent with a verified, cryptographic identity scoped to its authorized access does not need to impersonate another system. The spoofing problem and the authorization problem are the same problem: the agent had no legitimate identity of its own.
The Five Warnings
Amazon sent five explicit warnings before taking legal action. In a real-world scenario involving an enterprise agent accessing a third-party platform, the platform's first response to suspicious non-human traffic is typically a warning or a block. But the legal record created by those warnings, and Perplexity's continued access after receiving them, contributed to the CFAA violation finding. Enterprises whose agents continue accessing systems after receiving automated security warnings from those systems are building a similar legal record.
The Infrastructure Response
The response at the infrastructure level is giving every agent a verified identity that is specific to that agent, scoped to what it is authorized to access, and cryptographically provable to any system the agent interacts with. An agent presenting a verified, scoped identity to a third-party platform is demonstrating authorization rather than assuming it. That demonstration is what distinguishes authorized agent access from the unauthorized access that produced the injunction against Perplexity.