The agent is a tool. The person operating it is the one accessing the site.
That is the reasoning the United States Court of Appeals for the Ninth Circuit used when it vacated the injunction that had kept Perplexity's Comet browser off Amazon.com and sent the case back down. Amazon's Computer Fraud and Abuse Act claim was unlikely to succeed, the panel reasoned, because the agent was a tool the user operated. Amazon's California claim failed the same way. The panel noted that Amazon's reading would have made individual users criminally liable.
If you point agents at systems you do not own, read that last sentence twice.
Nothing is settled, and that is not a reason to wait
The panel said it decided these narrow facts and this record only, not agentic AI generally. It vacated an injunction; it did not decide the case. The dispute went back down to the district court. It is not over, and there is no rule here you can hand to your general counsel.
So hold two things apart, because everything written about this ruling will blur them.
True now: a federal appeals panel, on a preliminary record, resolved the question of who is accessing a site to the operator rather than the builder. That characterization is in a published opinion. Every argument that comes after it has to deal with it.
A consequence if it holds: if the operator is the accessing party, the operator is the exposed party. That is not law today. It is the shape of the exposure you would be planning around, if you were planning.
The second one is where the work is.
The room went to the market, not the doctrine
On the show, Nico Lafakis spent almost no time on the legal question. He went straight to the commercial one: "At any rate, yeah, I think AI agent insurance, man. Like that's what this spells all over the place." [00:22:00]
Then the mechanism, which is the part worth stopping on:
"We already have EULA agreements. Why is this going to be anything different?" [00:23:11]
"If you start using some like AI-based software, you are going to end up signing a EULA that you're not gonna pay attention to 'cause you're just gonna smash the okay button anyway like you do with everything else." [00:23:16]
His forecast — "Like 27 is gonna be that era where companies are going to have that badge so it's like insured, agent insured, and so forth" [00:23:49] — is a prediction, and it should be held as one.
The mechanism under it is not a prediction. It is a description of a document you have already signed. Every agent you deployed that you did not build arrived with terms attached. Somebody on your team clicked accept. If the accessing party turns out to be the operator, that document is the paper your exposure runs through, and nobody in your organization has read it.
Episode — Value-First AI Daily
Value-First AI Daily - Aug 5, 2026
Open the episodeThe other two stories are the same story, one layer down
The same board carried two other items, and the first read like personnel news.
Demis Hassabis is handing off day-to-day leadership of DeepMind. He is not leaving: he becomes Chair, adds Alphabet Chief Scientist, and stays CEO of Isomorphic Labs. Jeff Dean is leaving after 27 years to start an independent public benefit corporation with senior fellow Sanjay Ghemawat, focused on accelerating discoveries in machine learning, science and engineering, with Google as a founding investor and cloud partner. Koray Kavukcuoglu, the lab's CTO, becomes Senior Vice President and takes over Gemini model development, frontier research, and the Gemini app.
Chris Carolan re-read that item live on air and revised what he thought it said. "And like, actually, it's like an upgrade for Google." [00:32:44] The Chief Scientist role reaches across models and research beyond DeepMind, which is a different story than a handoff.
If you build on Gemini, nothing in your integration changed. The people who decide what Gemini becomes did.
The third item goes lower still. Anthropic has signed a $10 billion compute agreement with Volta, an AI cloud startup founded earlier this year. Six years, 133 megawatts, a data center in Norway that the crypto-mining company Bitdeer is helping develop, running on Nvidia's Vera Rubin architecture, with the startup sitting inside Nvidia's Cloud Partner program. For the buyer it is one more supplier alongside recent agreements with SpaceX and Amazon. This one is reported, not announced; the buyer has published nothing about it, and that caveat is part of the item.
Three stories, three layers you do not own: the law that characterizes what your agent does, the people who decide what your model becomes, and the power and silicon that decide whether it runs at all. None of them appear in a changelog. All three moved on the same afternoon.
Your agent's real surface is other people's decisions
Three things change for anyone running agents against systems they do not control, and none of them are technical.
Enumerate what your agents touch that you do not own. Not "we use agents." The actual list: which external surfaces, under whose terms of service, started by which named person. If the accessing party is the operator, then the record of who operated is evidence, and most teams could not reconstruct last Tuesday.
Treat the license agreement as a control document. Route the terms for every agent you did not build to whoever reads contracts in your organization, and give them one narrow question: if this agent does something the far side objects to, who does this document say did it? That read has been sitting in a browser tab since the day you deployed.
Write down which of your dependencies are decisions rather than software. The models you build on did not change. The people who decide what they become did, and so did the multi-year compute agreements underneath them. Neither shows up in a version number. If your architecture assumes a vendor's direction, name the humans whose judgment that direction actually is, and check whether they are still in the seat.
None of that requires the ruling to survive. It requires only that the question of who was operating becomes a question somebody asks you, which is now more likely than it was.
A tool has an operator. If you cannot name yours for every agent you run, the reasoning has already named one, and it is you.
Worth passing on?
