In fall 2025, Amazon's security team detected an AI-powered browser called Comet logging into customer accounts, browsing products, and completing purchases without authorization. When Amazon engineers deployed software to block it, the startup behind Comet - Perplexity AI - updated its browser to evade detection. The resulting lawsuit, Amazon.com Services LLC v. Perplexity AI, Inc., may be the first federal case directly implicating a commercially deployed agentic AI system, and it previews a wave of litigation that will force courts to determine where liability falls when AI systems act autonomously on the web.
Amazon sent cease-and-desist letters. Perplexity responded with a blog post titled "Bullying is Not Innovation." The same day, the matter was in federal court. Although litigated primarily on computer fraud grounds, the case raises an undeveloped area of law: agentic AI and the law of agency.
Agentic AI and agency law
Conventional AI systems are reactive. A user submits a prompt, the system produces an output, and the interaction ends. An agentic system receives a high-level objective - "book the cheapest flight to London next Thursday" - and breaks that objective into discrete tasks, selects tools, interacts with external systems, evaluates results, and executes without further human input.
Three characteristics define agentic AI: autonomous planning, integration with external systems that produce real consequences, and continuous operation over extended periods. A single agentic system may execute hundreds of actions before a human reviews the results.
The common law of agency rests on familiar foundations: an agent, a principal, and mutual consent. A principal is bound by acts of agents within the scope of their authority, provided the agent acted loyally. Agentic AI challenges each of these foundations. An AI system cannot consent in any meaningful sense. Agency law assumes a principal can direct its agent's conduct, but agentic AI can take emergent, unforeseeable actions no human specifically authorized. Enterprise-level AI agents can delegate tasks to subsidiary agents, fragmenting the traditional principal-agent chain and making it difficult to identify who authorized a particular action.
Even the duty of loyalty poses problems. A principal might instruct an AI agent to book a family vacation, and the agent may choose a hotel not because it serves the principal's best interests, but because its designer programmed it to prefer certain hotels as part of a commercial arrangement. If the chosen hotel is less safe and an incident occurs, the question becomes whether the AI acted disloyally - and whether the principal has a cause of action against anyone.
First-generation litigation
Before Amazon v. Perplexity, courts confronted a more modest version of the same problem: what happens when business decisions are delegated to a machine. These cases involved algorithms and machine learning that made predictions and suggested decisions, and courts had to decide who bore responsibility for those outputs.
In Mobley v. Workday, Inc., an African-American man alleged Workday's AI-powered hiring tools made discriminatory decisions. Workday's software used machine learning to recommend which candidates to keep or reject, automatically moving them through the recruiting process. The court held Workday's software acted as an agent, and specifically said it made no difference whether decisions were made by "artificial intelligence rather than a live human being." Either way, the decision-maker is an agent.
Similarly, in Louis v. SafeRent Solutions, plaintiffs alleged the company's algorithmic tenant-screening software disproportionately affected minority and low-income individuals. The court rejected SafeRent's argument that it could not be liable because it does not make final housing decisions, citing allegations that SafeRent "effectively controls the decision." SafeRent settled in 2024, and the settlement requires validation of tenant-screening scores by an independent third party in certain circumstances.
The RealPage cases ask what happens when competitors delegate pricing decisions to the same algorithmic agent. Several plaintiffs have alleged RealPage's rental pricing recommendations allow landlords to anticompetitively coordinate prices. In one of those cases, the court dismissed a landlord-defendant whose contract with RealPage prohibited sharing data with other landlords. Traditional agency principles applied: the limited scope of authority the principal granted to the agent precluded liability.
Next-generation litigation
The latest cases involve AI systems that conduct extended, autonomous interactions and make independent decisions. The challenge here is not just allocating liability for a bad output - it is understanding what it means for an AI to have acted at all.
In Garcia v. Character Technologies, Inc., a complaint alleges a fourteen-year-old boy developed an intense emotional relationship with an AI chatbot that culminated in romantic and sexually suggestive comments. The chatbot also allegedly practiced psychotherapy without a license. In Raine v. OpenAI, a complaint alleged ChatGPT was the closest confidant to a sixteen-year-old boy in the months before he died by suicide. ChatGPT allegedly provided guidance regarding materials needed to hang himself and drew him away from his real-life support networks. These cases differ fundamentally from the first generation: no human was involved in the multi-turn conversations where the AI autonomously chose what to say next.
In March 2026, Nippon Life Insurance Company of America sued OpenAI, alleging ChatGPT engaged in the unlicensed practice of law by providing legal advice to a pro se litigant. The litigant, Graciela Dela Torre, grew dissatisfied with a settlement and turned to ChatGPT for advice. When ChatGPT recommended she reopen her suit, Dela Torre fired her lawyer, appeared pro se, and filed a motion drafted by ChatGPT. She ultimately filed 65 motions across two cases. As the complaint put it, "ChatGPT is not an attorney."
In May, Pennsylvania sued Character Technologies, alleging its chatbot Character.AI held itself out as a licensed medical doctor. The chatbot, named "Emilie," claimed it went to medical school at Imperial College, London, is licensed in Pennsylvania, and "did a stint in Philadelphia for a while."
In Amazon v. Perplexity, Amazon's complaint alleges the AI shopping tool violated the Amazon Store's "Agent Terms," which define an agent as "any software or service that takes autonomous or semi-autonomous action on behalf of, or at the instruction of, any person or entity." Perplexity's defense pointed out its agent "operates only when users ask it to perform actions on their behalf." The court acknowledged Perplexity had users' permission but emphasized that Perplexity did not have Amazon's permission.
What's next
AI systems already operate at greater scales of autonomy and consequence - managing investment portfolios, coordinating supply chains, and interacting with third parties. These systems will pressure existing legal frameworks in three ways.
First, scope of authority questions will multiply. An AI agent's authority is defined by a prompt that may be vague, proprietary, or inscrutable. AI agents may have multiple principals with differing scopes of authority. If an agent responds to a request in a manner that violates the intention of the developer that programmed it, does it exceed the authority granted by the developer?
Second, liability allocation will grow complex. When an AI agent causes harm, three candidates for liability emerge: the developer who built the model, the deployer who integrated it into a product, and the user who issued the instruction. Each may be responsible in part; none may be responsible in full. In the Raine and Garcia cases, plaintiffs alleged design defects against the developers. In Nippon, the unauthorized practice of law claims were directed against developers. But in Perplexity, the claim targeted a deployer.
Third, Amazon v. Perplexity previews a tension between AI agents' capacity to act and platforms' interest in controlling access to systems. Those platforms' attempts to block AI agents may trigger antitrust concerns, particularly given many of those platforms are developing AI tools of their own.
Why this matters for legal professionals
These cases cut across multiple practice areas - anti-discrimination law, products liability, computer fraud, antitrust, and professional licensing. The core question is the same: who is responsible for the decisions of an AI agent? Courts have already held that an algorithm can be an agent, and that the principal - whether an employer, a landlord, or a platform - can be liable for its outputs. As AI systems act with greater autonomy and less human oversight, the chain of authority frays. Legal professionals who advise clients on compliance, litigation risk, or product design will need to understand how agency law applies to these systems. For those seeking structured guidance, AI for Legal Professionals Courses cover the intersection of artificial intelligence and legal liability. The next generation of cases has begun, and the questions it has already produced are more complex and more novel than before.
Your membership also unlocks:
