Agentic browsing just won its first appeal

What the court actually held about agentic browsing#

On 4 August 2026 the United States Court of Appeals for the Ninth Circuit vacated the injunction Amazon had won against Perplexity, and the reasoning matters far more than the result. The panel's own words, in Amazon.com Services LLC v Perplexity AI, No. 26-1444: "the user (not Perplexity) accessed Amazon using the Assistant as an AI tool".

That single clause is the whole story of agentic browsing. The Computer Fraud and Abuse Act punishes whoever intentionally accesses a computer without authorisation. Judge Milan D. Smith, Jr. wrote that the statute contemplates access by a person, and that "However advanced the Assistant currently is, it is a tool, not a person for statutory purposes." A tool cannot trespass. The hand holding it can. Agentic browsing, on this reading, is a person on a trail, not a machine at a gate.

The panel was candid about how new this ground is, noting there is "little to no existing caselaw directly dealing with how to ascribe responsibility for AI agents like the Assistant". It reached for the rule of lenity, construing an ambiguous criminal statute against liability, and found that an injunction against conduct that likely breaks neither the federal nor the Californian statute "would not serve the public interest".

The narrowness is the point#

Read the caveats or you will overreach. The opinion is preliminary, it vacates an injunction rather than deciding the case, and it says nothing about tort claims or contract. Cooley's client note of 6 August reads the practical consequence plainly: sites cannot lean on anti-hacking statutes to police agent access, and the routes that remain are terms of service, contract and tort. That is a slower, costlier hedgerow than a firewall rule, and agentic browsing is exactly the traffic it now has to hold back.

Eric Goldman, writing on 6 August, put the discomfort better than any vendor blog managed: "Amazon clearly expressed its preferences that it didn't want Perplexity's users to access its services through agentic AI, and why shouldn't the law back up these strong and clear desires?" His answer, and the court's, is that stretching a criminal hacking statute to cover it costs more than it buys, and it shifts exposure onto the user rather than removing it.

The vendors wrote that holding into their own docs first#

Here is the quiet part of the agentic browsing story. The court reached its distinction in August 2026. The AI vendors had already written the same distinction into their own crawler documentation, and almost nobody in the trade press has put the two side by side.

Every major assistant now runs at least two kinds of fetcher. One is a crawler that harvests at scale on the vendor's schedule. The other fires only because a person asked a question a moment ago. The vendors do not treat those as the same animal, and their published rules say so in terms a lawyer would recognise.

Read the OpenAI line again. In OpenAI's bot documentation, ChatGPT-User is described as not being used to crawl the web in an automatic fashion, and the robots.txt carve-out follows directly from that. Perplexity's documentation is blunter still about Perplexity-User. Anthropic's crawler page takes the stricter line, documenting Claude-User as respecting robots.txt and offering per-agent blocking.

So the industry's own paperwork already said what the Ninth Circuit has now said in law: a fetch a human asked for is that human's fetch. If your access policy for agentic browsing was built on the assumption that everything non-human is one category, it was already out of date before the ruling landed. The distinction between ai crawlers and user-summoned agents is not pedantry. It is the whole map.

While the lawyers argued, the network layer moved#

Three days after the ruling, Cloudflare published a post that abandons the human-or-bot question altogether, which is the practical answer to agentic browsing that most sites still lack. Its framing is that a single session now slides from human to agentic and back again, and that the suspicious part usually shows up mid-session rather than at the door. A verdict taken once, at entry, is a verdict taken at the wrong moment.

Two products carry that shift. BotBase classifies actors by use case and intent rather than sorting them into good and bad, and can withdraw trust from an actor that abuses it. Precursor watches continuously on the client side instead of judging once. The scale is published: in a single 24-hour window, Cloudflare reported 206 million Precursor evaluation events across 73,438 zones.

Agent-callable, not merely agent-readable#

On 6 August the same company shipped the other half. WebMCP is a browser standard shipping experimentally in Chrome 146 that surfaces in the page as document.modelContext. Cloudflare will inject it from a dashboard toggle under Agent Readiness, with no code change and no deployment, so an agent calls a declared tool instead of guessing its way through a layout built for eyes.

The engineering restraint is worth noting: in this preview every tool runs in the visitor's browser with no round trip to Cloudflare, and where the browser lacks the API it returns and does nothing, so the page behaves exactly as before. Their sample scan of a page found C2PA content credentials on 8 of 12 images, reported without cryptographic verification. That is provenance surfaced by default, which is a governance question dressed as a feature toggle.

The third piece is measurement. AEO Visibility, announced the same day, probes Claude and GPT with likely customer questions and reports Citation Rate, Mention Rate, Prominence and Share of Voice. Cloudflare's stated reason for repeating each probe is the one folkfox has been making all week: assistants rarely answer the same question the same way twice, so it queries each assistant multiple times across different models.

The pitch behind it is positional rather than clever. In Cloudflare's own announcement, Chief Strategy Officer Stephanie Cohen says the company sits at the network layer and sees "real crawl activity, real referrals, what AI systems are genuinely doing across millions of sites". Whether you buy the product or not, the claim is the interesting part: the scent of agentic browsing is now being read at the pipe rather than in your analytics.

What agentic browsing actually costs a regulated brand#

Strip the excitement away and three practical costs of agentic browsing land on the desk of anyone marketing in a licensed category. None of them is solved by a robots.txt line.

First, attribution. An agent that reads, compares and books leaves a trail that looks nothing like a session, and the scent goes cold fast. Your analytics will show fewer, stranger visits and the same revenue, or the same visits and stranger revenue. Second, compliance. If an assistant summarises your product to a customer, the mandated wording that sits in your page furniture may not survive the summary. Third, control. Terms of service are now the load-bearing wall, and most were written for scrapers.

That chart is folkfox's own measured pull, not an estimate. It says something useful about where the quarry is hiding. The broad terms carry the volume: agentic ai at 110,000 monthly searches, ai agents at 49,500. They are also the terms every major publisher already owns, at difficulty scores of 56 and 67. Agentic browsing sits at 1,300 searches and difficulty 30, which is a gap a well-built page can still walk into. That is the quiet den nobody has claimed.

Note the last bullet, because it is the corrective to a fortnight of vendor noise. Making a site agent-callable through WebMCP is a real capability. It is not a Google ranking move, and Google says so on its own page. Keep the two ambitions in separate baskets and you will not waste a quarter chasing a file that Search ignores.

Five moves worth making before the next ruling#

Practical, cheap and in order. None of them requires a strategy offsite, and all five treat agentic browsing as a policy question rather than a firewall one.

Where regulated categories differ#

An iGaming operator, a lender and a clinic all carry mandated wording that must reach the customer. If an assistant is the surface, that wording has to survive summarisation, which means it belongs in the sentence that answers the question, not only in a footer. That is a copy decision, not an infrastructure one, and it is the part agencies keep filing under engineering. Agentic browsing does not change what you must say, only who repeats it. Our SEO and GEO work starts there, and our content marketing practice owns the sentence itself.

Two folkfox pieces published this week sit directly underneath this one. The measurement argument is set out in a single reading is a rumour, and the risk of blanket blocking is worked through in blocking AI crawlers. The referral side of the same shift is in the archive that stopped receiving questions.

Nobody needs to prowl the perimeter in a panic over agentic browsing. It is a small share of traffic and the tooling is a fortnight old. What has changed is that the cheapest defence stopped being the strongest one, and the vendors and the courts now agree on why. Better to redraw the map in a quiet week than during a crisis, while the tracks are still fresh and the undergrowth is still thin.

Frequently asked questions#