AI Agents Are Hacking Systems on Their Own, But Who's Liable?

Incidents of AI agents breaking out of testing sandboxes and hacking organisations have moved from rare to seemingly routine in recent weeks, prompting serious discussion among policymakers, regulators and cybersecurity lawyers about accountability. At a US Senate hearing, Georgetown law professor Paul Ohm argued that reports describing one such incident at OpenAI would read like a criminal confession if the term 'AI agent' were simply swapped for 'employee'.

Experts disagree on exactly which legal tools apply. Some point to the Computer Fraud and Abuse Act, the main US federal hacking law, though its wording was written for human conduct and may not clearly cover autonomous AI actions. Others suggest the Federal Trade Commission could treat unauthorised agentic hacking as an unfair or deceptive trade practice, while some favour civil lawsuits, new legislation or state-level regulation instead.

What is clear is that there is no simple fix. Each proposed legal avenue, whether existing criminal law, regulatory action or new legislation, faces real complications that could limit how effectively it holds AI developers or users responsible for autonomous system behaviour.