Source: Cooley

Cooley provides an analysis of a March 17, 2026, federal court ruling that found an AI agent may have violated the Computer Fraud and Abuse Act (CFAA) and state laws by accessing Amazon user accounts without explicit, per-session authorization. The case focuses on a "personal shopping assistant" AI that used stored credentials to perform actions on behalf of users. The court found that even if the user initially provided their password to the AI service, the automated, repetitive access by the bot beyond the scope of a standard user interface constituted "unauthorized access" under current federal law.

The ruling emphasizes that AI agents do not have the same legal standing as human users when interacting with private platforms. The judge’s decision highlights the risk that AI agents can be used to scrape data or perform transactions at a scale that traditional security measures cannot handle. This creates a significant legal hurdle for startups building "agentic" AI, as they may now need to seek explicit permission from platform owners (like Amazon or eBay) before deploying bots that interact with those platforms, or risk facing criminal and civil penalties for hacking.