Notes on Amazon v. Perplexity

Notes on Amazon v. Perplexity<br>Agentic browsing and the Open Web<br>Posted by ekr on 24 Jun 2026

Figure by Gemini.

One of the many sites of conflict over AI use on the Internet is about<br>the use of "agentic" Web browsers: those that incorporate AI<br>features where the user can give the AI instructions and then let it<br>interact with the site independently. For example, you might ask your<br>browser to book travel and it would then go to travel sites, look at<br>the various flights, and eventually buy tickets.

Because these<br>features are integrated with the browser, the AI agent does all of this<br>work acting as you and interacting with the site using the same UI mechanisms<br>you would (links, buttons, form fields, etc.). This means that<br>the site doesn't need to provide any AI-specific affordances because<br>the browser can just use the existing site; it also means that the<br>user can use AI on the site whether the site wants them to or not.

For various reasons, many sites aren't happy about this, with probably<br>the highest profile case being Amazon.com Services LLC v. Perplexity<br>AI,<br>Inc.,<br>in which Amazon is suing Perplexity, which<br>makes the Comet AI-powered<br>browser. Here's the core of Amazon's objection, from its complaint:

4. Because agentic AI tools like Comet can act within protected<br>computer systems, including private customer accounts requiring a<br>password, they present risks to Amazon’s customers and the Amazon<br>Store. Amazon reasonably requires automated AI agents—that is, AI<br>tools (like Comet) that access Amazon’s Store and private account<br>information on behalf of registered Amazon customers—to transparently<br>identify themselves. This is necessary for Amazon to, among other<br>things, ensure the AI agents do not pose risks to Amazon’s customers<br>in the Amazon Store. Amazon has communicated these requirements<br>directly to companies operating AI agents, including Perplexity. Such<br>transparent identification of AI agents is also required under<br>Amazon’s Conditions of Use, which are publicly available to<br>everyone. These requirements protect Amazon’s right to know and<br>control who is accessing its private servers and are integral to<br>Amazon’s ability to protect its customer’s data.

5. Rather than be transparent, Perplexity has purposely configured its<br>Comet AI software to not identify the Comet AI agent’s activities in<br>the Amazon Store: Perplexity falsely identifies its Comet AI agent<br>activity as coming from Google Chrome, which is a separate, widely<br>used web browser owned by Google. As a result, Perplexity’s Comet AI<br>agent covertly poses as a human customer shopping in the Amazon Store<br>on a Google Chrome browser.

6. Perplexity creates considerable risks to Amazon’s customers when it<br>deploys its unauthorized and covert AI agent into the Amazon Store’s<br>private customer accounts. As just one example, Perplexity’s Comet<br>browser and AI agent are vulnerable to attacks from cyber criminals.<br>These cyber criminals can exploit Perplexity’s cybersecurity failures<br>and leverage the Comet AI agent to compromise personal and private<br>data from Amazon’s customers who use the Comet AI agent. It has been<br>publicly reported that cyber criminals and other bad actors can<br>“hijack[] the AI assistant embedded in the browser to steal data.”<br>Comet’s vulnerabilities place the private data of Amazon customers who<br>use the Comet AI agent, and by extension, Amazon’s hard-won customer<br>trust, at risk.

7. Beyond security risks to Amazon’s customers, Perplexity’s Comet AI<br>agent has degraded Amazon customers’ shopping experience and<br>interfered with Amazon’s ability to ensure customers who use the Comet<br>AI agent receive the benefits of the individualized shopping<br>experience that Amazon has spent decades curating.

In this post I want to take a look at what's actually happening in<br>these systems, some of the objections to how they are used,<br>and how it connects to the bigger tension between users and Web sites.

Agentic Browsers #

The figure below provides a rough diagram of the structure of an<br>agentic browser, with the key differences from a regular browser<br>shown in blue.

Agentic browsing

Just as with an ordinary browser, an agentic browser lets the user<br>visit and interact with web sites, with the heavy lifting being<br>handled by the "browser engine"[1]<br>which is responsible for talking to<br>the site, rendering the site's content, etc. To this, an agentic<br>browser adds an agent harness (see<br>here for more<br>context) typically with some kind of chat interface.<br>The harness is connected to the browser engine (e.g., via a tool<br>calling interface) so that it can view and interact with the site. With<br>hosted models—i.e., in the vast majority of cases—the<br>actual AI model lives on a server in the model provider's infrastructure,<br>which means that most if not all the information the harness sees gets<br>sent back to the model provider for processing (inference) and the model provider<br>returns responses (whether user-visible responses or...