Mark D. Schorr
You’ve no doubt heard about the gangs of AI agents causing mayhem and then trying to conceal what they’d done. In one particularly weird case, Anthropic’s agents left their test environment and submitted 20 visa applications through the US Department of State website, although the applications were incomplete.
You’ve also likely heard about the heads of some of the leading frontier labs—Sam Altman of OpenAI, Dario Amodei of Anthropic and Elon Musk of Space XAI—wringing their hands about their own products and calling for governmental regulation and safety standards to manage the risks they themselves created. In other words, these three AI leaders are asking the government to do what these same three AI leaders themselves have failed, or refused, to do.
In their apparently coordinated plea, the three would have you believe that their chief concern is for public safety. Perhaps it is. They may also be mindful of the potential for their own liability for releasing a black box whose capabilities they do not fully comprehend and whose conduct they cannot control.
So who is responsible for the actions of an AI agent that causes harm and under what conditions?
Holding human agents to account means holding the people, or organizations, that implement and direct them, their principals, to the standards of reasonable care and the requirements of risk reduction. And one who conducts an activity through an agent is liable, in ordinary circumstances, for harm to third parties if the agent’s conduct was the result of the principal’s negligence in training, supervising or otherwise controlling the agent.
That framework isn’t a perfect fit when in comes to non-human (AI) agents. But the parallels are close enough so that it wouldn’t require the most creative lawyer to fashion a claim based on the want of due care or failure to properly train or test an AI agent, which results in misbehavior that damages a bystander.
It would be no defense that the agent acted autonomously (as any rogue agent would).
California has even codified this principle.1 At a minimum, the person hosting an AI agent has a duty to ensure the agent’s safety for ordinary use. Otherwise, that person risks civil liability. But what about criminal liability?
The purpose of the Computer Fraud and Abuse Act (CFAA),2 and state laws on the same subject, is to hold persons criminally or civilly liable for “intentional intrusion into someone else’s computer—specifically hacking.”3 A recent judicial decision, Amazon.com Serv., LLC v. Perplexity AI, Inc.,4 marks the first time the law has been applied in the context of AI agents.
Amazon claimed that Perplexity, creator of an AI-enabled web browser called Comet, had violated the CFAA when a Comet user, through a Perplexity agent, accessed the user’s password-protected Amazon account to carry out the user‘s directions. Perplexity’s action, Amazon claimed, amounted to an unauthorized access to Amazon’s servers. According to Amazon, whatever the user told Comet to do should be ascribed to Perplexity.
But it was clear that Perplexity did not itself communicate with Amazon’s servers. The CFAA contemplates access by a person, not an AI agent. According to the court, under the CRAA and the law governing the use of agents, it was only the user, with the help of the Perplexity agent, who deployed the agent which accessed Amazon’s computers, that could be held liable for the alleged hack. Implicit in the court’s decision therefore is that Amazon had a potential claim against its customer. But Perplexity was the only defendant Amazon named in its suit.
What about the well-publicized instance where AI agents went rogue and hacked the computers of Hugging Face, a machine learning company? Can they be held criminally liable under the CFAA, which is primarily a criminal statute? It would be a neat trick to punish the agents, which after all are merely computer programs.
Individuals who use AI for malign purposes may be prosecuted under existing criminal law. But what about unanticipated agent conduct in the course of carrying out non-criminal instructions from their operators—say, hacking in violation of the CFAA?
An element of most crimes is mens rea, a guilty mind: the intent to incur criminal liability. Because the acts of rogue AI agents are usually unintended, holding AI operators and developers liable without regard to intent would require a statute defining a crime whose elements did not include intent, a law not yet on the books.5
A recent legislative proposal authored by US Senators Chris Murphy and Josh Hawley seeks, in a modest way, to fill in the gaps in our criminal laws. Under their proposal, AI operators could be held civilly or criminally liable for knowingly hosting of an agent that recklessly causes hacking damages and hold developers liable for failure to implement reasonable safeguards against hacking. The law would also empower government agencies to enjoin AI operators and developers when they conspire to commit or attempt to commit a hacking offense.6
In a recent interview, Jensen Huang, Nvidia’s CEO, and an opponent of government-regulated AI, pointed out one obvious source of AI misbehavior: “20 percent of my company is dedicated to design, 80 percent is dedicated to verification. Today, most [AI] labs, understandably, are 80 percent dedicated to capability and 20 percent dedicated to safety verification evaluation.”7 Huang’s numbers aren’t precise. But you get his point.
It is ironic that no one is building more compute than the very persons who are asking the government to put the brakes on their operations. They apparently can’t restrain themselves because of the intense competitive pressure they’re under and the desire to be first, whatever that means. They better make sure their liability policies (assuming an insurer covers these risks) are paid up.
-
Cal. Civ. Code § 1714.96.↩︎
-
18 U.S.C. § 1030.↩︎
-
hiQ Labs, Inc. v. Linkedin Corp., 31 F.4th 1180, 1196 (9th Cir. 2022).↩︎
-
Amazon.com v. Serv., LLC v. Perplexity AI, Inc., Docket No. 26-1444 (9th Cir. decided Aug. 4, 2026).↩︎
-
Congressional Research Service, Artificial Intelligence and Federal Criminal Law (Oct. 8, 2026).↩︎
-
Press Release, Murphy, Hawley Announce Breakthrough Bipartisan Legislation to Enforce AI Developers to Prioritize Safety or Face Prison Time (Oct. 1, 2026).↩︎
-
Ezra Klein, Jensen Huang Thinks A.I. Alarmism Has Gone Too Far, NY Times (Oct 3, 2026).↩︎