Who is responsible when my agent uses another company's website?

Website terms, anti-hacking laws, and bot detection when an agent browses, logs in, or transacts on sites you don't control, and how to design for it.

Short answer

Both you and your user can be. Your user is bound by their account agreement with the site, and your company can be liable directly if your product is designed to get around a site's rules. Website operators have started suing companies whose agents act on their platforms, so this is no longer a theoretical risk. The safest agents use official APIs where they exist, identify themselves, and never defeat technical barriers.

Where the risk comes from

• Website terms. Many sites prohibit bots, scraping, or automated purchasing. When your agent logs in as the user, the user's account agreement applies, and breaching it can get the user's account closed. If your company accepted the terms itself, or designed the product to violate them, you can face breach-of-contract claims directly.
• Anti-hacking laws. The federal Computer Fraud and Abuse Act and state equivalents prohibit accessing computers without authorization. In Van Buren (2021) the Supreme Court held that misusing information you are allowed to access is not "exceeding authorized access"; the law is about getting into places you aren't allowed. That doesn't let agents ignore access restrictions, bypass authentication, or keep going after permission is withdrawn. In Facebook v. Power Ventures (2016), the Ninth Circuit held a company liable for continuing to access Facebook with users' own credentials after Facebook expressly revoked its permission by cease-and-desist letter, even though the users consented. Not every breach of website terms is a computer-access violation, though contract claims remain.
• Defeating technical barriers. Bypassing CAPTCHAs, rotating IP addresses to avoid blocks, or disguising automated traffic as a human browser is the conduct most likely to turn a terms dispute into a much more serious claim.
• Specific laws. Some activities have their own rules, such as the federal BOTS Act for event tickets.
• Disputes with large platforms. Amazon sued Perplexity in November 2025, alleging that Perplexity's Comet browser agent accessed Amazon customer accounts without authorization, including by disguising automated activity. A district court granted Amazon a preliminary injunction in March 2026. The Ninth Circuit vacated it in August 2026. On that record, it found that the user, assisted by an AI tool, was the one accessing Amazon, not Perplexity itself, so Amazon was unlikely to succeed on its computer-access claims. The court left open whether a different design or more provider control over the agent would change the answer. This means Power Ventures can't be read as making every agent that keeps operating after a site objects a computer-access violation: who is actually accessing the system matters. The case is ongoing and the underlying dispute is unresolved. Expect platforms to keep testing these claims against agents that affect their business.

Who bears the loss

Your terms should say clearly that the user authorizes the agent to act in their accounts, that the third-party site's terms continue to apply, and how responsibility is shared when the agent's action breaches them. Terms help allocate risk between you and your user, but they do not bind the website, which can still pursue your company directly.

Designing for it

• Prefer official APIs and partnerships. API terms usually say clearly what automated access is allowed.
• Identify your agent. Use an honest user-agent string, and support emerging standards for signed agent traffic. Don't impersonate a human browser.
• Respect technical signals. Treat CAPTCHAs, bot blocks, and rate limits as a "stop," not a problem to solve. Hand the step to the user instead.
• Keep a denylist of sites whose terms prohibit agents, and stop if a site sends a cease-and-desist letter.
• Limit what the agent does on sites you don't have an agreement with: reading is lower-risk than buying, posting, or messaging.
• Keep the user's access the user's. The Ninth Circuit's distinction between a user acting with AI help and the AI company acting on its own suggests that architecture matters: whose session is used, who directs each action, and whether your servers access the site independently. It was a preliminary ruling on one record, so don't treat it as settled law.

Checklist an agent can run against the codebase

• List every site and API the agent can operate, and whether each is an official API or browser automation.
• Find the user-agent string and any code that changes headers, fingerprints, or IP addresses.
• Find how CAPTCHAs and bot challenges are handled.
• Check for a denylist or allowlist of sites, and how it is updated.
• Check whether the agent logs in with the user's credentials, and where they are stored.
• List the actions the agent takes on each site (read, buy, post, message, delete).

If this applies to you

An agent product review covers the sites your agent operates, your terms, and the design choices above. Adding a new site or a new kind of action is a pre-build feature check.