Consider a 12-person landscaping company. The office manager installs an AI browser agent and tells it to “reorder the usual irrigation parts and find the cheapest shipping.” The agent logs into the company's supplier account, adds 40 cases instead of four, accepts the supplier's updated terms of sale along the way, and checks out on the company card. Nobody looked at the order until the freight truck showed up.

Is the company stuck with that order? In most cases, the honest answer is yes. AI agents that browse, compare, and buy on your behalf are no longer a demo. Courts and websites have started deciding how they fit into existing law, and the early answers point the same way: what your agent does is treated as something you did.

What the Ninth Circuit decided in Amazon v. Perplexity

The case most owners have heard about is Amazon.com Services, LLC v. Perplexity AI, Inc. Amazon sued Perplexity in November 2025 over the Comet browser's built-in AI agent, which Perplexity calls the Assistant. When a user tells it to shop on Amazon.com, the agent navigates the site, fills a cart, and can check out. Amazon claimed this violated the federal Computer Fraud and Abuse Act and California's computer-access statute, because Amazon had told Perplexity its agent was not authorized. The district court granted Amazon a preliminary injunction.

On August 4, 2026, the Ninth Circuit vacated that injunction. The court held that Amazon was unlikely to prove that Perplexity itself “accessed” Amazon's computers. The statute punishes a person who accesses a computer, and the agent, “however advanced,” is “a tool, not a person for statutory purposes.” On the record before it, the court concluded: “It is the user who ‘accesses’ Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com.”

The panel was careful to say what it was not deciding. “We do not establish a new legal regime governing agentic AI,” the opinion says, and it does not address whether Perplexity could avoid liability for the agent's actions in other contexts, including tort claims. The holding is limited to “access” under the two computer-access statutes, at the preliminary-injunction stage, and on the facts presented. On September 10, 2026, the court denied rehearing en banc, and no judge on the full court requested a vote.

The case is not over. According to the district court docket, Amazon filed an amended complaint on September 21, 2026, and Perplexity moved to dismiss it on October 13, 2026. As of the end of October 2026, that motion was pending and the parties were in discovery disputes. No court has found that either side broke the law.

Why the user is the one who acts

For a business owner, the important part of the opinion is its framing. Amazon argued that the agent's autonomy made Perplexity the actor. The court rejected that and put the user in the driver's seat: the user chose the tool, gave the instruction, and used the tool to act on the website. The court even noted that Amazon's theory could have exposed users themselves to liability for “facilitating” the access.

That is a computer-crime holding, not a contract holding. But it lines up with how contract law already treats software that acts for you, and contract law is where most of your exposure sits when an agent buys something.

The contract rule: your agent's clicks are your clicks

Two overlapping statutes govern most electronic contracts in the United States: the federal E-SIGN Act and the Uniform Electronic Transactions Act (UETA), which many states have adopted in some form. Both anticipated software agents more than 25 years ago.

E-SIGN defines an electronic agent as “a computer program or an electronic or other automated means used independently to initiate an action or respond to electronic records or performances in whole or in part without review or action by an individual at the time of the action or response” (15 U.S.C. § 7006(3)). An AI shopping agent fits that description comfortably.

Then 15 U.S.C. § 7001(h) provides that a contract in interstate commerce “may not be denied legal effect, validity, or enforceability solely because its formation, creation, or delivery involved the action of one or more electronic agents so long as the action of any such electronic agent is legally attributable to the person to be bound.”

UETA goes further. Utah's enactment, in force since 2000, is a good example. Under Utah Code § 46-4-401, a contract “may be formed by the interaction of electronic agents of the parties, even if no individual was aware of or reviewed the electronic agents' actions or the resulting terms and agreements.” Read that again with the landscaping company in mind. Nobody at the company reviewed the order or the updated terms, and the statute says that doesn't matter.

Whether the order is “attributable” to the company is answered by Utah Code § 46-4-203: an electronic record is attributable to a person “if it was the act of the person,” and that act “may be shown in any manner,” including by the security procedure used. An agent operating inside your logged-in account, with your saved payment method, after your employee told it to buy, is going to look like your act.

Two cautions. First, state versions of UETA vary, and section numbers differ from state to state, so check your own state's statute before relying on any particular wording. Second, nothing here means every agent action binds you no matter what. Attribution still runs through ordinary agency and contract principles, and a seller who knew the order was wrong is in a different position from one who had no reason to think so. But the starting presumption favors the seller.

The error rule probably won't rescue you

Owners often assume there is an “oops” provision for computer mistakes. UETA does have one, but it was written for a different problem. Under Utah Code § 46-4-204(1)(b), an individual may avoid an electronic record that resulted from an error the individual made “in dealing with the electronic agent of another person” if that other person's system gave no opportunity to prevent or correct the error. The individual must also promptly give notice, return or destroy what was received, and not have used or benefited from it.

That rule protects a person who fat-fingers an order on someone else's automated system. By its terms it does not address a mistake made by your own agent acting for you. When neither of the statute's specific rules applies, the error “has the effect provided by other law, including the law of mistake, and the parties' contract.” In practice, that usually means you are negotiating with the seller under its return policy, not invoking a statutory right to unwind the purchase.

The website's terms may ban the agent entirely

The Ninth Circuit added a footnote that matters more for owners than the headline holding. Its ruling, the court wrote, “does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users.” In other words, losing a computer-crime argument does not stop a website from writing contract rules about agents.

Amazon has done exactly that. Its Conditions of Use, last updated August 14, 2026, now include “Agent Terms” that apply if you “use, allow, enable, or cause the deployment of” an agent on Amazon's services. An Agent is “any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity.” Under those terms, an agent must:

No agent may use the services at all if Amazon has asked it to refrain. The same Conditions of Use say the licenses Amazon grants “terminate if you do not comply.” Notice who those terms bind: you, the account holder, if you allow or cause the deployment. If your agent doesn't comply, the breach is yours, and the account at risk is yours.

Amazon is the most visible example, not the only site that can write rules like these. Supplier portals, marketplaces, travel sites, and SaaS vendors can each decide whether agents are welcome. Before you point an agent at a vendor, read that vendor's current terms.

If you sell, the same rules work for you

Flip the facts. If your customers start sending agents to your online store, UETA's attribution rule helps you: an order placed by a customer's agent is generally that customer's order. Your terms of sale decide the rest. It is worth asking whether your terms say anything about agents, whether you want to require them to identify themselves, and whether your checkout gives a buyer (human or software) a clear chance to confirm before the order is final. A clear confirmation step also cuts off the error defense described above, since that rule applies only when the system offered no opportunity to prevent or correct the mistake.

Controls that keep agent purchases inside the lines

The law will keep developing, but the risk is manageable now with ordinary purchasing controls adapted to software.

Give the agent its own payment method with a low limit. A virtual card with a per-transaction and monthly cap turns a runaway order into a small problem. Never let an agent use a card with your full credit line.

Require a human approval step before checkout. Most agent tools can pause for confirmation. Turn that on for every purchase, every subscription, and every “I agree” click. Approval should show the total, the quantity, and any terms being accepted.

Limit where the agent can go. Use an allowlist of vendors whose terms you have reviewed and who permit agents. Keep the agent out of accounts that can bind the company to long-term contracts.

Decide who may deploy agents, in writing. An agent acting on a company account is acting for the company. Your employee AI use policy should say who can run agents on company accounts and for what.

Read the agent provider's contract. Find out what the provider promises about errors, whether it identifies itself to websites, and whether it disclaims all liability for the agent's actions. Most standard terms put the risk on you. Our AI vendor contract checklist lists the clauses worth asking for.

Keep logs. If a dispute arises, you will want the instruction the employee gave, the steps the agent took, and the screens it saw. Logs are also your best evidence if a seller's system, not your agent, caused the mistake.

For the broader question of when a business answers for what its AI tools do, including the theory that an AI vendor can act as an employer's agent in hiring, see when is my business liable for AI.

Frequently asked questions

Can I cancel an order my AI agent placed by mistake?

Possibly, but usually under the seller's return or cancellation policy rather than a legal right. UETA's error rule is written for an individual's mistake on another party's automated system. A mistake by your own agent generally falls back on the law of mistake and the contract terms. Contact the seller quickly and keep records.

Did the Ninth Circuit say AI agents are legal on any website?

No. It held only that Amazon was unlikely to win its computer-access claims against Perplexity on the record at the preliminary-injunction stage. It expressly preserved a website's ability to regulate agents through its terms of service, and the case is still pending in the district court.

If my agent breaks a website's terms, is that my problem or the agent provider's?

Often yours. Terms like Amazon's Agent Terms bind the user who allows or causes the agent's use, and the consequence can be losing access to your account. Whether you can recover anything from the agent provider depends on your contract with it.

This article reflects the Ninth Circuit's August 4, 2026 opinion and September 10, 2026 order in Amazon.com Services, LLC v. Perplexity AI, Inc., the district court docket, the cited federal and Utah statutes, and Amazon's Conditions of Use as of November 2026. State electronic-transaction statutes vary. This is general information, not legal advice for your situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.