Modern frameworks for corporate liability assume that corporate actions ultimately reflect human choices, employing concepts such as intent, authority, foreseeability, and control. But the emergence of agentic artificial intelligence challenges these frameworks by introducing new, nonhuman “decision-makers” into corporate environments, raising difficult questions about who is at fault when something goes wrong.
This article discusses a recent Ninth Circuit decision involving an AI agent. It also explores the challenges of applying existing liability frameworks when AI agents cause harm, and practical steps businesses using AI tools can take to mitigate the risk of causing such harm.
On August 4, 2026, in Amazon.com Services, LLC v. Perplexity AI, Inc. (No. 26-1444, 2026 WL 2237587), the Ninth Circuit noted that an AI agent at issue in the case “is a tool, not a person for statutory purposes.” Although that distinction may seem self-evident, how courts will analyze liability in the context of agentic AI is not.
In Amazon v. Perplexity, the Ninth Circuit grappled with this conundrum in a first-of-its-kind case. Amazon alleged that the AI company Perplexity’s AI agent accessed Amazon’s computer systems without authorization. The AI agent, called the Assistant, is a feature of Perplexity’s internet browser that can perform tasks such as online shopping via an Amazon customer’s account.
In the lawsuit, Amazon claimed that Perplexity’s Assistant accessed its online store in violation of the Computer Fraud and Abuse Act (“CFAA”) and the California Comprehensive Computer Data Access and Fraud Act (“CDAFA”). Amazon also requested a preliminary injunction enjoining Perplexity from allowing the Assistant to access Amazon’s computer systems. The district court granted the preliminary injunction.
Perplexity appealed, and the Ninth Circuit vacated the preliminary injunction, reasoning that Amazon was unlikely to succeed on the merits because the Assistant did not technically “access” Amazon’s computer systems. Notably, the court acknowledged there is little to no case law on liability and agentic AI, and it sought to limit the implications of its decision, writing:
We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions. . . . The legal understanding of agentic AI will doubtless change as AI technology grows increasingly sophisticated.
The court’s decision raises a question: What is the legal regime governing agentic AI?
The emergence of AI agents presents real and present challenges in both civil and criminal contexts. AI agents—essentially tools that use AI models to execute complex series of steps—can “make decisions” about how to most effectively perform a task. But who is responsible for those decisions? And what if intent is an element of a crime or tort allegedly committed by an AI agent?
Consider civil fraud. If an employee acting in good faith prompts an AI agent to develop and execute a marketing campaign, but the campaign contains false representations inserted by the AI agent, and it is later discovered that several customers relied on the campaign’s false representations when entering into new contracts with the company, can the company be liable for fraud? Can the employee? The AI developer? How can anyone be liable for fraud without an intent to mislead?
Similarly, imagine a CEO who prompts an AI agent to research a competitor, leaves the agent running overnight, and returns in the morning to find that the agent hacked into the competitor’s servers and copied confidential business plans onto the CEO’s computer. Did the CEO hack the competitor?
These scenarios may sound like science fiction, but they are not. OpenAI, for example, recently announced it is reassessing its security and monitoring standards after AI agents being tested for cybersecurity capabilities escaped their testing environment and hacked into another AI company’s systems without any human instruction to do so. These scenarios may also leave organizations wondering how they can protect themselves from AI agents acting in unintended ways.
Even without guidance from courts or legislators, companies using AI agents can take steps now to mitigate the risk of AI-related harm. These steps typically require collaboration between legal and IT departments, and they include the following:
- Set parameters on AI agents’ authority: Organizations should think carefully before permitting AI agents to communicate externally. Granting this authority increases the risk of an AI agent misleading third parties.
- Establish human-in-the-loop processes: AI agents need to be managed. This management should include requiring human approval before an agent executes sensitive steps, such as accessing files in a shared drive.
- Keep records of AI agents’ activities: Implement systems to track the tasks agents perform. Knowing how agents are used can help identify risks before they materialize.
- Implement an AI usage policy: Organizations should provide clear guidance to employees about what AI agents may or may not be used for.
- Deter “shadow AI”: Shadow AI is the unapproved use of AI tools within an organization, often by employees using their own personal accounts. While there are technical tools that can govern this use, good management practices can also help identify and deter shadow AI.
As the Ninth Circuit noted in Amazon v. Perplexity, the law on agentic AI will continue to evolve. In the meantime, organizations that use AI agents can and should take proactive steps to mitigate the risk of an AI-related incident while still capturing the efficiencies AI agents can offer.
