Notes on Amazon v. Perplexity
Short summary
This post breaks down Amazon’s lawsuit against Perplexity over its Comet AI agentic browser, which browses and transacts on users’ behalf while disguising itself as Chrome. It explains how these browsers work, the security risks they introduce—like prompt injection attacks—and why sites like Amazon demand transparent agent identification.
- Amazon's lawsuit claims Comet disguises itself as Chrome, hiding the AI agent's true identity from Amazon's systems.
- Agentic browsers share the user's actual cookies/passwords/session data, so a compromised AI agent can act with full access as if it were the user.
- Amazon's complaint cites a public report of prompt-injection attacks hijacking embedded AI assistants to steal private data.
- Amazon argues Comet's covert automation bypasses and degrades its personalized shopping features built over years.
Full summary
Amazon’s lawsuit against Perplexity centers on Comet, an AI-powered browser that can sign into private accounts and carry out tasks—like booking flights—using the site’s own interface. Amazon says Comet hides its identity by spoofing Google Chrome, bypasses Amazon’s rules for automated agents, and exposes customers to risks if the browser is compromised. In its complaint, Amazon points to three core problems: security holes in Comet that cybercriminals could exploit to steal user data; interference with Amazon’s tailored shopping features; and deliberate concealment of the AI agent’s true origin.
Under the hood, agentic browsers wrap a standard browser engine with an AI “harness.” When you type instructions, that harness turns them into clicks, form-fills, and navigations. With hosted models, every page the AI sees is sent to a server for inference before the harness issues the next browser command. If the agent shares cookies, passwords, or IndexedDB data with your normal session, it acts exactly like you. Strip away those secrets, and it’s just another anonymous client.
Agentic browsing introduces fresh attack vectors beyond ordinary browser bugs. Prompt-injection attacks can trick the AI into revealing sensitive information or executing unintended commands. Amazon’s complaint highlights a public report showing how attackers could hijack an embedded AI assistant to siphon private data. At the same time, Amazon argues that Comet’s covert automation disrupts the personalized recommendations and features Amazon spent years building, degrading the shopping experience for anyone using the AI agent.