Amazon sues Perplexity, saying its agent logged in as customers

FACT (CONFIRMED): On Monday 2026-09-21, Amazon.com Services LLC filed a 41-page First Amended Complaint in the N.D. Cal. case it opened on 2025-11-04 against Perplexity AI. The amended pleading (Dkt. 122) replaces the original two-claim complaint with three counts: (1) Computer Fraud and Abuse Act (18 U.S.C. § 1030), (2) California Comprehensive Computer Data Access and Fraud Act (Cal. Penal Code § 502), and (3) NEW — tortious interference with contractual relations under California law. Jury demand maintained.

The new material targets "Comet for iOS," the mobile version of Perplexity's Comet browser/agent that launched March 18, 2026 — nine days after Judge Chesney granted Amazon's preliminary injunction (Mar 9, 2026). Amazon alleges (COMPANY CLAIM, quoted from the complaint):

• "When a user activates Comet's agent mode on iOS, Comet copies the user's Amazon-authenticated cookie and session data to Perplexity's cloud servers, which host a virtual browser. Perplexity's cloud servers then request pages directly from Amazon's servers using that virtual browser and the user's copied cookie... No user device touches Amazon's servers."
• This direct server-to-server traffic was observed "day after day," from shortly after the March 18, 2026 launch until at least May 11, 2026, "all while Perplexity was representing to the Ninth Circuit that 'no Perplexity computer ever has direct access to an Amazon computer.'"
• Requests coming from Perplexity's servers carried the user-agent string of "Google Chrome running on a Windows desktop computer" (an iOS product presenting as desktop Chrome); Comet's own in-app notice reportedly told users "[t]his request will be handled by a virtual cloud browser."
• Amazon alleges Perplexity's statements to the Ninth Circuit (opening brief filed April 1, 2026; reply brief May 6, 2026) "were false when made"; Amazon's counsel wrote to Perplexity's counsel on May 6, 2026 identifying the misstatements by page and asking for correction; Perplexity's counsel replied on May 11, 2026 that "[a]s a measure of good-faith, Perplexity has temporarily disabled the assistant feature on Amazon.com in Comet for iOS" — without denying the direct connections or correcting the record before the appeals court.

FACT (CONFIRMED): The same day (Sep 21), Amazon also began blocking Meta's freshly launched Muse shopping agent on Amazon.com with Conditions-of-Use popups (independent of this filing but same-week context; see S14). Perplexity had not filed a response to the amended complaint as of Sep 21–22; its public, in-case-quoted position is that Amazon is "demanding we prohibit Comet users from using their AI assistants on Amazon."

• Pleading scope: 2 claims (CFAA, CDAFA) → 3 claims (+ tortious interference with contract). The new claim leans on Amazon's customer agreements (Conditions of Use with Agent Terms added May 30, 2025) rather than on anti-hacking statutes alone — an explicit response to the Ninth Circuit's Aug 4, 2026 opinion, which vacated the preliminary injunction and held that (on the prior record) the user, not Perplexity, "accesses" Amazon's computers (18 U.S.C. § 1030; "the Assistant is a tool, not a person"), while noting the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users" (footnote 5, No. 26-1444).
• Factual theory: Amazon pivoted from "agent impersonates Chrome in the user's local browser" to "Perplexity's own servers logged in and browsed Amazon directly, with no user device in the middle" (iOS architecture). This aims squarely at the appellate panel's open question: "We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers."
• Credibility dimension: the amended complaint accuses Perplexity of making court representations "false when made" and of not correcting them — a candor-to-the-court theme that is new and, if proven, aggressive.
• Numbers on the record (alleged, CONFIRMED as pleaded): damages "well in excess of $260,000"; ≥1,280 engineering hours (8 Traffic Engineering staff) since July 2025; ≥185,712 Comet sessions on Amazon.com as of June 15, 2026; separate Ad Traffic Quality + Traffic Engineering losses (>$5,000) from Mar 18–May 11, 2026 server-to-server detection; two technological barriers (Aug 19 and Dec 5, 2025) each evaded within days.

• BEFORE (2025-11-04 → 2026-08-04): Amazon sued Perplexity (Nov 4, 2025) over Comet covertly entering password-protected customer accounts — "Buy with Pro" (Nov 2024), Comet release (Jul 9, 2025), block (Aug 19, 2025), evasion (Aug 20, 2025), executive contacts (Sep 12/29, 2025), free launch (Oct 2, 2025), cease-and-desist (Oct 31, 2025). Judge Chesney granted a PI (Mar 9, 2026) on CFAA/CDAFA. Perplexity appealed; its briefs (Apr 1, May 6, 2026) said no Perplexity computer ever directly accesses an Amazon computer. Ninth Circuit vacated the PI on Aug 4, 2026 (user accesses, not the company; rule of lenity); rehearing denied Sep 10, 2026; mandate issued Sep 18, 2026 (docket entry 121). Perplexity moved to dismiss (Sep 11, 2026, docket 119).
• CHANGE (2026-09-21): Amazon files the First Amended Complaint (Dkt. 122): new iOS direct-access theory + tortious-interference claim + "false statements to the Ninth Circuit" allegations; requests injunction, destruction of copied data, account identification, damages, jury trial.
• AFTER: Case proceeds with Perplexity's pending motion to dismiss (hearing reset to Nov 20, 2026 per docket 120 order; responses previously due Sep 25, 2026); Perplexity must answer or amend its dismissal strategy to confront the new allegations. The amended complaint is now the operative pleading, and the contract claim gives Amazon a route that does not depend on the "access" prong the court of appeals rejected.

Mechanism as alleged (COMPANY CLAIM, corroborated by Perplexity's own in-app notice quoted in the complaint):

1. A Comet for iOS user activates "agent mode" on a shopping task in the Amazon Store.
2. Perplexity's iOS app copies the user's Amazon-authenticated session cookie (the credential that lets Amazon treat the holder as the signed-in customer) to Perplexity's cloud.
3. Perplexity's servers run a "virtual browser" that requests pages directly from Amazon's servers using that cookie — the requests originate from Perplexity's infrastructure, not the user's phone ("No user device touches Amazon's servers").
4. Amazon's servers respond to the impersonated session, including password-protected pages, directly to Perplexity's servers; screenshots are streamed back to the user's phone.
5. Requests carried a desktop-Chrome user-agent string (per Amazon), so server logs did not self-identify the traffic as agentic; Amazon says its Ad Traffic Quality and Traffic Engineering teams had to trace the traffic to Perplexity-controlled servers manually.
6. Contrast — Amazon's own "Buy for Me" agent (April 2025) identifies itself via an "Agent/[agent name]" user-agent and an "@buyforme.amazon" ordering identity, accesses only public pages, and respects opt-outs; Amazon's Agent Terms (May 30, 2025) require third-party agents to do the same and to stop when told.

Where the old complaint's theory was "the agent uses the user's browser as a cover," the amended theory is "Perplexity's computers themselves entered Amazon's computers using customers' copied credentials." The legal stakes: CFAA/CDAFA "access" by the company (vs. by the user), plus contract liability for inducing customers to breach the Conditions of Use.

• First major federal test of agentic-shopping architecture itself. The Ninth Circuit's Aug 4 opinion left an explicit door open ("on a different record or new facts"). Amazon walked through it on Sep 21 with the iOS direct-access record. If the allegations hold, the "user did it, the agent is just a tool" defense collapses for cloud-virtualized agents — a pattern (per Meta's own Muse materials and P.K. Sharma's comparison table) that Muse and other "buy for me" products also use.
• Timing is deliberate and demonstrative: the filing landed the same weekend Amazon blocked Meta's Muse with Conditions-of-Use popups — i.e., contract enforcement in the market and in the courthouse, exactly the lever footnote 5 of the appellate opinion preserved.
• It extends the platform-vs-agent rulemaking wave of this window (UN IIASPAI brief on losing human control over agents, S05; Shopify/Meta Muse launch, S14; California's N-9-26 kill-switch EO, S04) into concrete private-law litigation about who may log in as a customer.

• Retailers/platforms can now point to a live, on-spec complaint alleging that server-side cookie replay by an agent vendor is computer fraud + tortious interference — a litigation template (federal CFAA + California CDAFA + common-law interference) any platform operator can adapt.
• The amended complaint formally put "agent vendors must self-identify in the user-agent string" (the Agent Terms "Agent/[name]" rule) into a federal pleading — a technical norm now being litigated.
• Agents that stay on the user's device (client-side execution) gained a clearer safe-ish lane: the appellate record says that pattern is the user accessing; server-side virtual browsers are the exposed lane.

1. How will Perplexity respond to the amended complaint — amend its pending motion to dismiss, or answer with a factual rebuttal of the iOS architecture?
2. Will Judge Chesney's Nov 20, 2026 hearing on the pending dismissal motion now address the amended pleading (claims 1–3), and what survives?
3. Was the Comet-for-iOS server-side architecture actually in place for the full Mar 18 → May 11, 2026 window, and what do Perplexity's engineering records show?
4. Does the "false when made" candor allegation affect the Ninth Circuit's pending posture, rehearing, or any future appeal?
5. Will Amazon's contract-based (tortious interference) approach become the model against Muse, Google and OpenAI agents — and will any of those vendors sue back (Amazon already blocked their agents)?
6. Does data-destruction relief (copied session data, screenshots, HTML snapshots) set a consent/retention standard for agent vendors?

• Perplexity's response to the amended complaint (due per schedule; its pending dismissal motion predates the amendment — expect a revised or supplemental motion targeting all three claims).
• Motion-to-dismiss hearing: Nov 20, 2026 (reset from Oct 16 by docket 120 order) — first substantive district-court test of the iOS allegations and the new interference claim.
• The Ninth Circuit carries the August opinion (mandate issued Sep 18, 2026); any new appeal will test whether the Comet-for-iOS record "gains entry" under the panel's own reservation.
• Watch the Muse block interplay: contract-popups and the Amazon v. Perplexity docket form a matched pair; a ruling on the interference claim could directly shape the Muse standoff and agent blocks by Google/OpenAI agents.
• PREDICTION (explicitly forward-looking): the case resolves via compliance architecture rather than a sweeping merits ruling — expect an identification/opt-out settlement framework or a narrow holding that server-side logged-in browsing by an agent vendor can constitute access; a broad "all agent shopping is illegal" ruling is unlikely given the panel's caution and amicus climate.

This is the week's cleanest example of the agent-economy legal frontier: a retailer says "your agent logged in as my customer, on your servers, while telling a court it never touches my systems." The amended complaint is significant not for naming a wrongdoer — nothing is proven — but for naming the failure class (cookie-replaying, non-identifying, server-side shopping agents) and turning a technical architecture dispute into federal pleading, exactly when consumer "buy for me" agents reached mass market (Shopify/Meta's Muse; Amazon blocking agents from Google and OpenAI). The durable lesson for builders: how your agent represents itself and where its requests originate is now a compliance decision with federal-law consequences, not just an engineering detail. And the durable lesson for audiences: an AI that "shops as you" from someone else's servers is a very different legal object than an AI that helps you click — and courts, contracts and platforms are all starting to enforce that distinction.