On September 20, 2026, twelve days after Meta launched its Muse agent in the US, Amazon began blocking it. Shoppers who sent Muse to Amazon saw one line: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed" (as reported).
The last clause is the story. The warning cites no federal statute. It cites a contract with Amazon's own customers. Forty-seven days earlier, a federal appeals court had pointed to such terms as the lever Amazon still held.
What the Ninth Circuit decided on August 4
Amazon sued Perplexity in November 2025 over Comet, an agentic browser, under the Computer Fraud and Abuse Act and its California analogue. A district court granted a preliminary injunction in March 2026. On August 4, the Ninth Circuit vacated it (Amazon.com Services v. Perplexity AI, No. 26-1444).
The panel held: "It is the user who 'accesses' Amazon's computers," with the agent's help. However advanced, the agent "is a tool, not a person for statutory purposes." Footnote 5 adds that the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users."
The ruling is narrow by its own terms. It concerns a preliminary injunction, on one record, in one circuit. It leaves tort claims open, says it does "not establish a new legal regime governing agentic AI," and sends the case back to the district court.
What Amazon's terms already said
Amazon did not need new rules. Its Conditions of Use carry a section called Agent Terms. An agent is "any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity."
The section binds the customer. It applies "if you use, allow, enable, or cause the deployment of an Agent." It sets four duties: declare "Agent/[agent name]" in every request's user agent string, never mimic human keystrokes or solve CAPTCHAs, answer truthfully when asked, and never circumvent a block.
The text predates the Perplexity complaint by about five months. The version dated September 14, 2022, as archived on May 2, 2025, has no Agent Terms. The version dated May 30, 2025, archived on June 9, 2025, has them.
We compared that version with the current one, dated August 14, 2026, ten days after the ruling. The Agent Terms are unchanged apart from clause numbering and punctuation. What changed is dispute resolution: court litigation in King County gives way to binding individual arbitration, a class action waiver and batching rules for mass arbitration.
We read the sequence as a shift of enforcement surface, not as proof of intent. The statute reaches the vendor only if the vendor "accesses." The contract reaches the customer who enables the agent, and that customer's disputes over its use of Amazon now go to individual arbitration, with narrow exceptions.
After August 4, a platform's firmest lever over a third-party agent is not a statute. It is the contract with its own customer, plus the technical right to limit access. Hikari Blue · operator note
Where the value sits
Amazon reported $68.6 billion of advertising revenue in 2025, 9.6 percent of $716.9 billion in net sales and 22.1 percent above 2024 (Form 10-K, fiscal 2025). The filing says this revenue "is recognized as ads are delivered based on the number of clicks or impressions."
In our reading, that is the value an undisclosed agent puts in question. An agent that reads screenshots and picks a product on stated criteria is not the audience sponsored placements are priced for. Amazon's declarations told the court that Comet "may not select the best price, delivery method, or product recommendations." The panel found that harm "more abstract."
The mechanism is competitive position. Whoever controls the agent at checkout controls ranking, and ranking is where retail media earns. Amazon's statement on Perplexity says such agents "should operate openly and respect service provider decisions whether or not to participate."
The same opinion records that Amazon "launched agentic AI products in 2025." The standard it sets for other agents is the one its own agents will be measured against when they shop elsewhere.
Who else is exposed
The appeal drew amicus briefs from the National Retail Federation and from Airlines for America. Any enterprise whose customers log in to buy, book or pay faces the same question. When a customer's agent arrives, who decides, on what signal, and under which contract?
The vendor side is already clear. Meta says Muse "can open a browser, fill out forms, and negotiate on their behalf," and "has no visibility into people's passwords or payment methods" (Meta, September 8, 2026). Amazon says Muse did not identify itself and appeared to capture and store customer credentials (The Register, September 21, 2026).
Both statements can hold for different layers of the same system. Neither describes a policy the merchant controls.
What management examines now
Put agent access on the product agenda, not only the security one. The decision is admit, license or block, per agent and per customer journey. Amazon's four duties are a usable first draft for your own customer terms.
Instrument identity before enforcement. A user agent string is self-declared, and the opinion records a dispute over whether Perplexity altered its string after Amazon first blocked it. Detection needs behavioral signals, and each session needs a log of the actions an agent took.
Offer a sanctioned path. Amazon's own analogies are delivery apps with restaurants and travel agencies with airlines: intermediaries that operate under agreement. A declared agent channel keeps price, ranking and service terms in your hands. That control plane is what we build as the AI operating layer.
What could prevent value capture
Blocking has a cost the panel named: an injunction here "would impair consumer choice." Enforcing a contract against your own customers is a service decision before it is a legal one. The ruling binds courts in one circuit and may be revisited on a fuller record. An agent that follows every rule still moves ranking power off the page.
When a customer sends an agent to our checkout, which contract governs it, which log proves what it did, and who earns the ranking?
Carry one number into the next review: the share of authenticated sessions and orders that arrive through declared agents, next to the undeclared automation you detect. Add conversion and dispute rates for agent orders. When the declared share rises, the channel is yours. When the undeclared share rises, it belongs to someone else.
- United States Court of Appeals for the Ninth Circuit (August 4, 2026). Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, opinion by Judge Milan D. Smith, Jr., for publication. Primary source for: the complaint filed in November 2025 under the CFAA and California Penal Code section 502; the preliminary injunction granted in March 2026; the vacatur and remand; "It is the user who 'accesses' Amazon's computers"; "a tool, not a person for statutory purposes"; footnote 1 on the disputed alteration of the user-agent string; footnote 5 on regulating access "via private terms of service for its users"; the statement that the opinion does "not establish a new legal regime governing agentic AI" and does not address tort claims; Amazon's declarations that the Assistant "may not select the best price, delivery method, or product recommendations"; the finding that such harm is "more abstract"; "would impair consumer choice"; Amazon "launched agentic AI products in 2025"; the amicus briefs of the National Retail Federation and Airlines for America. ca9.uscourts.gov, opinion No. 26-1444
- Amazon.com, Conditions of Use, last updated August 14, 2026, read on September 29, 2026. Primary source for: the Agent Terms, their definition of "Agent," their application "if you use, allow, enable, or cause the deployment of an Agent," the four technical requirements, the right to limit agents "including by technical measures," and the binding arbitration, class action waiver and mass arbitration provisions. amazon.com, Conditions of Use
- Internet Archive, two captures of the same Amazon page. The capture of May 2, 2025 shows the version "Last updated: September 14, 2022," with no Agent Terms. The capture of June 9, 2025 shows the version "Last updated: May 30, 2025," with the Agent Terms. Our comparison of the May 30, 2025 text with the August 14, 2026 text finds the Agent Terms identical apart from clause numbering and punctuation, and finds that the May 30, 2025 version resolved disputes in the state or federal courts of King County, Washington. We did not examine versions, if any, published between these two dates. web.archive.org, capture of May 2, 2025 · web.archive.org, capture of June 9, 2025
- Amazon.com, Inc. Form 10-K for the fiscal year ended December 31, 2025. Primary source for: advertising services net sales of $68,635 million in 2025 and $56,214 million in 2024; consolidated net sales of $716,924 million in 2025; advertising revenue "recognized as ads are delivered based on the number of clicks or impressions." sec.gov, Amazon Form 10-K, fiscal 2025
- Meta Platforms (September 8, 2026). Introducing Muse. Primary source for: the US rollout; Muse "can open a browser, fill out forms, and negotiate on their behalf"; Muse "has no visibility into people's passwords or payment methods." about.fb.com, Introducing Muse
- Amazon, statement about Perplexity. Primary source for: third-party applications "should operate openly and respect service provider decisions whether or not to participate," and the analogies with delivery apps, delivery services and travel agencies. aboutamazon.com, statement about Perplexity
- The Register (September 21, 2026) and mixed-news.com (September 2026), press reports used for press facts only: the start of the block on the night of September 20, 2026; the warning text shown to users; Amazon's stated reasons, including that Muse did not identify itself and appeared to capture and store customer credentials; Meta's reply on credential storage. theregister.com, September 21, 2026 · mixed-news.com, Amazon blocks Meta's Muse
- Our arithmetic. Launch to block: September 8 to September 20, 2026 is 12 days. Ruling to block: August 4 to September 20, 2026 is 47 days. Ruling to terms update: August 4 to August 14 is 10 days. Advertising share: 68,635 divided by 716,924 is 9.57 percent. Advertising growth: 68,635 divided by 56,214 is 1.221, or 22.1 percent.
The Hikari Blue team · Austin, September 2026