Ninth Circuit: Your AI Agent Can’t Violate Hacking Law. But You Might.

Legal Issues

from the agentic-law dept

The rise of AI is bringing a bunch of fascinating legal questions that are harder to answer than many expect. The latest one: who is liable if an agentic system running on its own hacks someone? That’s the question a bunch of people have been asking this past week in the wake of multiple stories of agentic tools breaking out of their sandboxes during testing. But it’s also a question that the Ninth Circuit brushed up against this week, in a ruling that says an agentic tool isn’t the one doing the “accessing” under the federal hacking law. A person is. The challenging part is figuring out which person.

There’s obviously been plenty of talk over the past couple of weeks regarding agentic tools supposedly going “rogue.” There was, of course, the story of OpenAI’s tools hacking Hugging Face, the AI repository (also covered on Ctrl-Alt-Speech). And then soon after, Anthropic admitted that “hey, our models kinda did something similar.” And while these are generally referred to as the bots going rogue, the reality is not quite that. The bots are doing literally what they were asked to do: accomplish some goal by any means necessary. And in both stories, they found ways to accomplish their goals, often by hacking into other systems or doing things we would normally consider malicious.

In the case of OpenAI and Hugging Face, it appears that the tool did what plenty of hackers try to do, just a whole hell of a lot faster. It found a zero-day vulnerability to break out of the sandbox OpenAI thought it had created. It then took a series of steps to enable it to hack into Hugging Face. In Anthropic’s case (which only came to light after the OpenAI incident caused Anthropic to go back and look) the situation was a bit different. Some of the tests included prompts telling the agentic tools that they were in a sandboxed simulation. But because of a configuration error, they really weren’t. And since the models had been told flat out in the prompt that everything around them was simulated, when they found a way out, they reasonably concluded that the way out was part of the simulation too.

Either way, I’ve seen some discussion online wondering why these two companies aren’t being charged with violating the Computer Fraud and Abuse Act (the CFAA). We’ve written about the CFAA for years, mostly in how it’s a badly worded law that has been abused in both civil and criminal cases to go after “anything I don’t like on a computer” rather than its actual purpose of targeting genuine hacking. And CFAA lore goes back to 1988 and the infamous Morris Worm, in which Robert Morris accidentally created an internet virus that took down portions of the then still small internet. Morris was found guilty of violating the CFAA for doing so.

Which has some people asking how are these other two stories any different. But the general consensus is that there are unlikely to be any CFAA violations here, in part because the CFAA requires intentional access, and in part because no human ever made the decision to break in. I would separately argue that the lack of real damage (unlike the Morris Worm) helps here as well. TechCrunch floats a more cynical version of the same point: that the DOJ’s appetite for a CFAA theory might look very different if these agents had come out of a Chinese lab rather than one a short drive from the US Attorney’s office:

The Department of Justice could theoretically bring criminal charges under the CFAA, but one former litigator specializing in computer law also expressed doubts.

Prosecutors might have an easier case if any of the cyberattacks had targeted critical infrastructure, which would have caused greater real-world disruption and more tangible harm than copying data from a company’s internal database.

It is also plausible that if the attacks were carried out by a Chinese AI model maker, for example, the DOJ would have a greater appetite to file charges under the CFAA than against AI companies on its own doorstep.

But, just as this discussion heated up, the Ninth Circuit Court of Appeals (sort of) weighed in on a separate, ongoing case that Amazon filed against the AI company Perplexity. Perplexity has an “agentic browser” allowing users to tell the agent to accomplish tasks — such as “buy me toilet paper on Amazon” — and the agent goes off and does that independently. Amazon, unsurprisingly, hates this. Its entire storefront is engineered to get humans to buy more than they came for, and an agent that buys the toilet paper and leaves is immune to every last bit of it.

So Amazon notified Perplexity that its agent isn’t allowed on the site. Perplexity, taking the position that a browser a user drives is a very different thing from a giant centralized scraping operation, kept letting its users point the agent at Amazon — and routed around Amazon’s blocking by not sending an identifying user-agent string. Which, it’s worth remembering, is something browsers, privacy tools, and testing frameworks do every single day.

But Amazon argued that this made Perplexity’s agent a CFAA violator, because routing around a block should count as ‘unauthorized access’ (which is central to the CFAA). Amazon sought a preliminary injunction blocking Perplexity’s tools from reaching Amazon and the district court granted it. But now the Ninth Circuit has rejected that, noting that a computer by itself cannot violate the CFAA, because the CFAA’s language “contemplates access by a person.”

The CFAA’s plain language suggests the Assistant itself cannot “access” Amazon’s servers. The relevant provision of the CFAA punishes “[w]hoever . . . intentionally accesses” a “protected computer.” 18 U.S.C. § 1030(a)(2) (emphasis added). In other words, the CFAA contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes. See 18 U.S.C. § 921(a)(1) (“The term . . . ‘whoever’ include[s] any individual, corporation, company, association, firm, partnership, society, or joint stock company.”); see also Whoever, Cambridge English Dictionary, [https://perma.cc/YY3TVTJF] (last visited July 16, 2026) (“[T]he person who” (emphasis added)).

Which raises the obvious Morris Worm question: the worm wasn’t a person either, and Morris still went down for what it did. But that’s exactly the distinction the court is drawing. Morris wrote the code, released it, and no one else was involved — the “whoever” was sitting right there. When a user tells an agent to go buy toilet paper, there’s a human in the chain, and the court says it’s the user, not the tool and not the company that built it.

The Supreme Court has instructed that, “in the computing context, ‘access’ references the act of entering a computer system itself or a particular part of a computer system, such as files, folders, or databases.” Van Buren, 593 U.S. at 388 (internal quotation marks omitted). Our focus is thus to ask whether Perplexity uses a tool (the Assistant) to “access” Amazon’s computers. On the facts before us, we answer no. It is the user who “accesses” Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com. To be sure, Perplexity may receive screenshots of the user’s browser and may communicate instructions to the Assistant. But those activities, by themselves, do not mean that Perplexity has “accessed” (gained entry) to Amazon’s servers. We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon’s servers. On the current record, Amazon is not likely to succeed in proving the “access” prong of its CFAA claim.

The court also seems well aware of how badly the CFAA has been abused (especially in criminal law) and recognizes how an alternative outcome would be a mess:

Another note of caution: Amazon’s approach, if accepted, could expose users themselves to criminal liability (under a conspiracy or aiding-and-abetting theory) for facilitating Perplexity’s purported unauthorized access to Amazon’s servers. We are conscious of precedent cautioning against “transform[ing] whole categories of otherwise innocuous behavior into federal crimes simply because a computer is involved” or “criminaliz[ing] a broad range of day-to-day activity.” Nosal I, 676 F.3d at 860, 862 (internal quotation marks omitted). In our view, it is unlikely that Congress would have exposed individual users to criminal liability under the CFAA by using the Assistant and Comet browser to access Amazon.com under these facts. On these narrow facts and given the care with which we must interpret the CFAA to ensure defendants are on notice, we decline to adopt Amazon’s interpretation of § 1030(a)(2).

The court does caution that its ruling should be seen narrowly, and admits there could be other cases which are CFAA violations. But a browser with an agent built into it, doing the bidding of a human user, is not that:

Because we recognize that agentic AI is an emerging technology, we reiterate what this opinion is not. We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions. Our holding here is limited to “access” as contemplated by the CFAA and as applied to the Assistant’s interactions with Amazon.com on the record before us, not the broader legal landscape surrounding agentic AI. The legal understanding of agentic AI will doubtless change as AI technology grows increasingly sophisticated. For now, this opinion reflects and applies to the state of technology only as presented in the filings in this case.

While the court seeks to distinguish this ruling from the very problematic Power Ventures case (which said that users authorizing a third party tool with their own password to access Facebook for the purpose of creating a unified dashboard for social media was a CFAA violation), I think this ruling is a further narrowing of that ruling from a decade ago.

I’ve argued for years that the Power Ventures case was a key moment in locking up the open web, because it blessed Facebook’s desire to close off its platform from the wider web, leading to the world of internet giants operating as silos. In that case, the court found that it was Power who was violating the CFAA rather than the user, even though it was clearly the user authorizing access. That enabled platforms to lock up all their data in silos and try to block any third-party tool from getting it out, deepening lock-in and making useful “exit” harder.

Here the results come out very differently, and very much for the better.

A handful of cases over the past few years have thankfully chipped away at the very broad Power Ventures ruling, and this is the latest. Given how much of the web is about to be browsed by agents rather than eyeballs this may be the most consequential such ruling.

But, at the same time, it still leaves open the idea that OpenAI and Anthropic could face CFAA claims in the future, even though it’s their bots that accessed things in an unauthorized manner. While this latest ruling says that bots alone can’t violate the CFAA, the entity driving them could. So there could be cases where these companies could face CFAA liability for how they configure the tools when they run these tests. The “intentionality” question will still be a hurdle for any CFAA claim to overcome, but I don’t think this particular ruling should have OpenAI and Anthropic breathing any easier — other than in the narrow case where either of their browser agents, operated by a user, accesses unauthorized systems. Pointing an agent at the open internet, telling it to accomplish a goal by any means necessary, and then misconfiguring the box that was supposed to keep it in is a very different fact pattern from a user asking Comet to reorder toilet paper. The CFAA is also hardly the only law with something to say about an aggressively overhelpful bot that causes real damage.

It also leaves open something more uncomfortable: the user might be liable. If the user is the one “accessing,” then a platform that wants to ward off agentic browsing now knows exactly who to target: the users. The Ninth Circuit points out that it was unlikely that Congress meant to expose individual users to criminal liability under the CFAA (which is correct), but… lawyers filing civil claims don’t care about that. And a demand letter doesn’t even need to turn into a lawsuit to work. The only thing holding a company like Amazon back from going after users for their use of agentic tools may be the very likely public backlash if they did so.

That’s the real lesson from this ruling. Rather than making the liability vanish, it moves it around. That’s genuinely good news in a post-Power Ventures world for all sorts of things including price-comparison tools, accessibility overlays, researchers auditing platforms, and anyone building the interop layer a giant would rather not exist. But it may also leave those same users in a legal gray zone where an aggressive set of lawyers may decide to target them when they get fed up with agentic tools. Perhaps Amazon is smart enough not to go there. Then again, the recording industry spent the better part of a decade suing its own best customers, and plenty of lawyers told them it was a great idea at the time.

Filed Under: 9th circuit, agents, cfaa, hacking, liability, negligence
Companies: amazon, anthropic, openai, perplexity