A tool, not a trespasser
On August 4, 2026, the US Court of Appeals for the Ninth Circuit vacated a preliminary injunction that had barred Perplexity's AI agent, Assistant, from shopping on Amazon on users' behalf. Amazon had argued that Perplexity's browser violated the Computer Fraud and Abuse Act (CFAA) and California's Comprehensive Computer Data Access and Fraud Act (CDAFA) by accessing Amazon's servers without authorization — even when the person logging in was the account holder themselves. The district court had agreed, granting Amazon's injunction on March 9, 2026. The appeals panel disagreed, holding that when a user directs an AI agent to act on a website, it is "the user who 'accessed' Amazon's computers," not Perplexity. The Assistant, the court said, is a tool, not a person, for statutory purposes (Ninth Circuit opinion, Amazon v. Perplexity, No. 26-1444). It is, per law-firm trackers, the first federal appellate decision to squarely address CFAA liability for agentic AI systems (Cooley).
The Knight First Amendment Institute, which filed an amicus brief in the case, called the outcome a defense of "user control" against a computer-crime statute being "stretched to penalize tools that automate a user's access to their own information" (Knight Institute). That framing matters beyond the US. The CFAA's core question — who is the legal actor when software acts on a human's instruction — is not an American peculiarity. It is a question every jurisdiction with a computer-access statute will eventually have to answer, and India's is one of the oldest and broadest such statutes in the world.
Steelmanning Amazon's position
Amazon's argument deserved to be taken seriously, and the district court initially agreed with it. Perplexity's Assistant did not merely browse Amazon on a user's behalf — it logged into password-protected accounts, filled carts and completed purchases, all while allegedly not identifying itself as an automated agent, in apparent violation of Amazon's terms of service. A platform has a legitimate interest in knowing whether a login is a human being reading a page or software executing a shopping script at scale, since the two carry very different fraud, security and infrastructure-load risks. Treating every AI-agent visit as legally identical to a person clicking a mouse could let developers build tools that route around platform rules with a thin "the user told it to" defense, no matter how much autonomy the software actually exercises. The Ninth Circuit did not reject that concern outright — it left open that direct-to-server agents with less user mediation, or claims sounding in contract and tort rather than the CFAA, could still expose developers to liability (Cooley).
Where India's law would land differently
India's Information Technology Act, 2000 does not track the CFAA's exact language, but it raises the identical question through Section 43, its civil-liability provision for unauthorized computer access. Section 43 imposes compensation liability on anyone who "accesses or secures access" to a computer system without the owner's permission — but it goes further than the CFAA in one important respect: it separately penalizes anyone who "provides any assistance to any person to facilitate access to a computer... in contravention of" the Act (Section 43, IT Act, 2000, via Indian Kanoon). That assistance clause is broad enough that an Indian court, unlike the Ninth Circuit, would not need to strain to reach an AI agent developer — a plaintiff could plausibly argue that a company building the agent "assisted" the unauthorized access, without ever asking whether the software itself is a legal "person." Section 66 escalates the same conduct to a criminal offense — up to three years' imprisonment or a fine of up to ₹5 lakh — where dishonest or fraudulent intent is shown (Section 66, IT Act, 2000, via Indian Kanoon).
India has no equivalent appellate ruling, no MeitY guidance note, and no Digital India Act provision that resolves this. The techno-legal AI governance framework MeitY has floated flags "unauthorised access" as an agentic-AI risk and proposes agent identity, authentication and kill-switch controls — but it is guidance, not binding law, and it stops well short of allocating liability between user and developer the way a court now must.
Why the assistance clause is the wrong tool for this job
An Indian court following Amazon's logic — that any facilitation of access is itself sanctionable — would criminalize the basic architecture of agentic AI: software that logs in, clicks and buys on a user's explicit instruction. That outcome would not protect Indian platforms from real hacking; Section 43 and 66 already reach credential theft, scraping-at-scale and system disruption regardless of who or what "accesses" second-hand. It would instead hand every Indian platform a private veto over which AI tools its own users may authorize to act for them — enforced not through contract or terms of service, which is the appropriate remedy, but through the threat of criminal prosecution. The Ninth Circuit's distinction is the right one for India to adopt through eventual judicial interpretation or Digital India Act text: liability should track autonomy and authorization, not the mere presence of software in the chain between a user's intent and a platform's server. Until an Indian court or legislature says so explicitly, every agentic AI product built for Indian users operates under exactly the ambiguity the Ninth Circuit just resolved for American ones.