Agent Identity Goes to Court: Amazon v. Perplexity

Amazon sued Perplexity over a question every site will soon have to answer: when an AI agent shows up at your door, does it have to say it is an agent? Amazon.com Services LLC v. Perplexity AI is now before the Ninth Circuit, and it is the first major legal fight over whether an autonomous browser must disclose itself or may dress up as a human. The technical fact at the center is small and damning. Perplexity’s Comet browser is Chromium-based, and it sends Chrome’s User-Agent string rather than identifying as an agent.

That single design choice is the whole case in miniature. Amazon reads it as deception. Perplexity reads it as how agentic browsing is supposed to work. Both readings are coherent, which is exactly why this lands in court instead of in a config file.

The Disclose-or-Impersonate Line

Amazon’s complaint, filed under the Computer Fraud and Abuse Act, makes two distinct accusations that are worth separating. One is about the header: Comet “masquerades as Chrome” instead of announcing itself. The other is about the behavior: the agent “covertly poses as a human customer.” According to Eric Rescorla, who wrote the analysis this piece draws on, the first accusation is weak on its own terms. User-Agent strings have been theater for decades. Chrome itself ships a header stuffed with “Mozilla” and “Safari,” tokens that describe nothing real. Rescorla notes that Vivaldi and Brave “flat-out lie about the UA string” to dodge sites that discriminate by browser. If spoofing the UA string were illegal access, half the web would be in violation already.

The second accusation is where the case gets interesting, and Rescorla’s read is that it cuts to the core of the product. The agent poses as a human because, in his words, “that’s the whole point of agentic browsing.” You asked it to shop for you. It is shopping as you. Strip the human disguise and the feature stops working, because the site’s defenses are built to stop exactly this.

The fault line runs below header honesty, at a question the web has never had to answer: does a site have the right to know that the thing on the other end is software acting for a person, and is the agent obligated to tell it? The web has no neutral answer to that question yet. There is no standard handshake where an agent declares “I am an agent operating on behalf of this user under these constraints” in a way the site can verify. Without that handshake, every agent faces a binary choice: disclose and get blocked, or blend in and get the job done.

Identity You Cannot Verify Is Identity You Cannot Govern

Here is the deeper problem the lawsuit exposes. A site cannot reliably tell a human from an agent. That alone breaks access control, because access control assumes you can identify who is knocking. But the same blind spot runs one layer deeper, inside the agent itself.

Rescorla points to Brave’s proof-of-concept attack as the warning shot. A user asks Comet to summarize a Reddit page. The page contains hidden instructions. The model reads the page, cannot tell the user’s request apart from the attacker’s injected text, and acts on both. In the demonstration, the attacker compromised the user’s Perplexity account and exfiltrated email from their Gmail. The same agency that lets the agent shop for you is the agency that lets a stranger’s webpage issue commands in your name.

The root cause is structural. Models “don’t really distinguish between different sources of input.” User instruction and page content arrive as one concatenated stream of text, and the model treats them as equally authoritative. So identity collapses twice over. A site cannot verify whether the visitor is a human or an agent. And the agent cannot verify whether a given instruction came from its user or from a hostile string it scraped thirty seconds ago. Both failures are the same failure wearing two costumes: a system that cannot authenticate the source of an action cannot govern it.

This is the through-line from identity to role. We have argued that an agent’s role is unverifiable in current systems, that “developer” or “reviewer” is a label nobody can cryptographically prove (notes from Cloud Next on AI identity and security). Identity is the same problem one rung down. If you cannot prove who the actor is, the role you assign it is decoration. The Brave attack is what an unverifiable identity looks like when someone weaponizes it.

Accountability Follows Deployment

If a site cannot identify the actor and the agent cannot authenticate its own instructions, then liability has to attach somewhere concrete. The lawsuit’s most useful move is to force that question into the open. Amazon’s attorney argued that “if you sever the connection between Perplexity and the user’s computer, everything stops,” and concluded that Perplexity is therefore the operator. Rescorla pushes back, and the disagreement is instructive. He calls the dependency an “implementation artifact.” The inference happens to run on Perplexity’s servers, but it need not. A smaller model could run locally, and then “all of the externally visible side effects, like network requests, come from the user’s browser, not from Perplexity’s servers.”

So who deployed the agent? The honest answer is that it is genuinely contested, because the vendor can “remotely update the local agent,” pushing new model weights and system prompts at will. The user pointed the agent at Amazon. The vendor shaped how the agent reasons. Treat Rescorla’s legal predictions as one informed opinion rather than settled law; he disclaims legal expertise. But the governance lesson holds regardless of how the Ninth Circuit rules. When identity is unverifiable, accountability cannot rest on the request, because the request is forgeable. It rests on deployment: who built this agent, who configured its permissions, who can update its behavior, and who pointed it at a target. Those are answerable questions, and they are the only ones with a paper trail.

Mozilla’s Web Vision frames the stakes from the user’s side: individuals have “the final say” over what acts on their behalf. That principle is right, and it does not resolve the case. A user’s final say over their agent does not grant the agent the right to impersonate the user to a third party that never consented to deal with software. Two legitimate parties, two legitimate claims, and no shared protocol to reconcile them. That vacuum is the actual subject of the lawsuit.

This is not a fringe dispute either. Rescorla notes parallel scraping suits already in motion: Google and Reddit are both suing SerpAPI over proxies and fake user-agent strings that “make traffic look like regular user traffic.” The disclose-or-impersonate question is arriving from several directions at once.

Do This Now

Inventory every agent your organization runs against a third party, internal or external, and answer two questions for each. First, when that agent hits a system you do not own, does it disclose itself or impersonate a human session? Write down the answer, because right now it is probably undocumented and probably the second one. Second, if that agent processes untrusted content, a webpage, an email, a support ticket, can you prove which instructions came from your operator and which came from the content? If you cannot, you have a Brave-style injection surface live in production.

Then attach accountability where it actually lives. Not on the request, which is forgeable, but on deployment: a registry of which agents exist, who owns each one, what permissions it holds, and who can change its behavior. Deployment is also where agent code and its blast radius are decided, which is why accountability has a paper trail there and nowhere else. Amazon v. Perplexity may take years to resolve. The exposure it describes is in your stack today, and it does not need a court ruling to be exploited.

---

This analysis synthesizes Notes on Amazon v. Perplexity (Educated Guesswork / Eric Rescorla, June 2026), whose legal predictions are one informed opinion rather than settled law.

Victorino Group helps teams make agent identity and accountability designed properties, not courtroom surprises. Let’s talk.