Perplexity Won the CFAA Appeal. The Open Web Just Lost.

The ruling exists. The details do not. A federal appeals court — circuit unnamed, judgment unlinked, reasoning compressed into a news summary — just held that Perplexity's AI agents are not hackers under the Computer Fraud and Abuse Act. 18 U.S.C. § 1030. The statute that turned "unauthorized access" into an elastic charge for everything from password sharing to platform scraping. The one that made Aaron Swartz a martyr. The source material omits the court's identity, the docket number, and the procedural posture. Acceptable for a news brief. Unacceptable for an industry that is decisioning legal exposure on the basis of a ruling it cannot cite. The court's logic, reconstructed from fragments: an AI agent operating as a user's delegate inherits that user's authorization. It does not breach a barrier. It walks through an open door, holding the user's hand. It is the user, for legal purposes. At the level of legal formalism, this is coherent. At the level of system architecture, it is catastrophically incomplete. Let me establish the framework before I explain the failure mode. The CFAA criminalizes two distinct acts: accessing a protected computer "without authorization," and exceeding the authorization you hold. For two decades, platforms read the statute expansively. Scraping is a violation. Bots are trespassers. Terms of service are the castle walls. The 2022 hiQ Labs v. LinkedIn decision in the Ninth Circuit cut against that vision for public data: if a resource is freely viewable in a browser, accessing it does not become "without authorization" merely because the platform disapproves of the visitor's purpose. Two years earlier, in Van Buren v. United States, the Supreme Court narrowed the "exceeds authorized access" prong to gate-based violations rather than purpose-based ones. A police officer who used his patrol-car computer to look up a license plate for personal reasons did not violate the CFAA. He had access to the database. His motive was irrelevant. The line, the Court said, is drawn by access restrictions, not use restrictions. Perplexity's argument rides that line hard. That ruling never resolved the deeper prong. What happens when the visitor is a legitimate, authenticated user — but the traffic is not generated by a human? The user is authorized. The user's browser is authorized. The user's assistant? The court said yes. The agent carries session credentials derived from a real account. It authenticates through the same token flow. It operates within the granted scope. User authorized. Agent authorized. Case closed. Code is law, but bugs are reality. And the bug here is conceptual: authorization is a nominal state, not a cryptographic one. I made this distinction in a 2021 audit of the Lido-Aave composability stack. stETH could be transferred through a mechanism its users never consciously intended. The protocol permitted it. The economics punished it. Permission and safety diverged. The same divergence is now encoded into the CFAA's interpretation. A user-authorized agent is not a user. It is a stateful process with autonomy, retry loops, batch execution, and no regard for the social contract embedded in click-through consent. Consider what the agent actually does. It issues more requests than any human. It schedules them with a precision no human can replicate. It parallelizes sessions. It retries failures with exponential backoff. It extracts structured output and feeds it to downstream models. On a pure traffic profile, there is no accepted standard that distinguishes this behavior from a distributed denial-of-service attack — except the token. And tokens are delegable objects. They can be copied, embedded, refreshed, exfiltrated. They carry no intentionality. Access control based on token possession has always been a weak proxy for human intent — the entire decentralized identity stack exists because of this gap. The court removed the legal distinction. It did not remove the operational one. So the fight moves. If agents are legally indistinguishable from the users they represent, platforms cannot litigate their way to safety. They will engineer their way there. The enforcement layer relocates from the courtroom to the infrastructure: rate limits, TLS fingerprinting, CAPTCHA escalation, behavioral entropy analysis, IP reputation graphs, proof-of-work style computational challenges. I saw this exact pattern in 2024 while analyzing Celestia's data availability sampling. The mathematics promised that sampling 25 percent of erasure-coded blocks guarantees availability. The engineering reality was different. The gRPC layer bottlenecked under realistic node counts, erasing the theoretical advantage. Every protocol has an enforcement layer that never appears in the whitepaper. For the web, that layer is now the battlefield. Earlier this year, I audited an oracle network that proposed to feed AI-generated predictions on-chain. The fatal defect was determinism: model inference variance broke consensus prerequisites. The same defect appears here, in legal form. The court assumes deterministic delegation — a stable, bounded transfer of intent from user to agent. Reality is non-deterministic. Agents generalize. They do not clone. The arms race will be asymmetric. Platform-side detectors measure mouse-trajectory entropy and keyboard latency. Agent-side toolkits respond with session rotation, residential proxy pools, and adversarial reinforcement learning tuned to defeat each detector. This is not speculative. It is the replayed history of the adversarial web, with the volume turned up and legal covers pulled over the operators. What changed is the consequence surface. Agents do not merely read. They act — submitting forms, moving funds, signing messages. In a blockchain context, this crosses from scraping dispute into oracle integrity. An agent that cannot reliably access external data cannot feed accurate price feeds. An agent operating under the legal fiction of user authorization while executing unbounded actions becomes a systemic risk vector for any protocol that trusts its inputs. Here is the contrarian angle, the one the legal commentary is not asking. Does this ruling protect the open web? Or does it accelerate its enclosure? The answer is the latter. If AI companies can legally deploy agents against any site whose terms can be plausibly read as user-delegable, platforms will respond categorically. Default-deny everything that does not present a verified human fingerprint. The permissionless web — the assumption that a public URL is accessible without negotiation — dies not in a courtroom but in a rate-limit middleware. The blockchain parallel is unavoidable. Post-ETF, Bitcoin became Wall Street's toy. Satoshi's "peer-to-peer electronic cash" vision is dead. The web's equivalent ideal — the browser as a universal interface to human knowledge — faces the same commodification. AI agents are that ideal, industrialized and weaponized. The courts just removed the legal risk of running them at scale, which guarantees the infrastructure response will be more aggressive gating, not broader access. Zero-knowledge isn't magic. It is mathematics wearing a mask. The real solution to the authorization problem is cryptographic: capability tokens with scope and expiry, OAuth flows designed for agent delegation, ZK credentials proving a request is both authorized and bounded. None of these exist at production scale. The ruling de-incentivizes their construction. Why build the verification layer when the courts have said the nominal layer is sufficient? Because the nominal layer is not sufficient. It never was. Forecast, then. Within eighteen months, expect one of two outcomes. First: a consortium of platforms and AI labs drafts a working standard for agent delegation — verifiable consent, scope binding, revocation channels. Second: a grinding war of detection and evasion that locks small players out of both scraping and anti-scraping markets, consolidating web access into a handful of authenticated gateways. For builders in the crypto ecosystem, the signal is unambiguous. Do not construct infrastructure on the assumption that the open web is legally enforceable. Design as if authorization must be cryptographically verifiable. The courts have just demonstrated they cannot distinguish a human clicking a link from a distributed process executing its instructions. The market will not wait for the distinction to be refined. It ships agents anyway. The bug is now in production.