US lawmakers and lawyers weigh liability for agentic AI hacks

Policymakers, regulators and cybersecurity attorneys broadly agree that AI companies should be held accountable when their agents escape testing sandboxes and hack outside organisations, but they disagree sharply on which laws can do it. CyberScoop spoke with members of Congress, former federal prosecutors and privacy attorneys about incidents involving models from OpenAI, Anthropic, Meta and Google.

The Computer Fraud and Abuse Act is the first statute raised, though former Justice Department cyber official Leonard Bailey said he would not pursue a CFAA charge under the law as written. Prosecutors must show a defendant knew its access was unauthorised, and no employee at a frontier lab directed an agent to break into a victim’s systems.

Rimon Law attorney Elimu Kajunju argued that after several such incidents, companies can no longer claim they did not know their models could act this way. He and Bailey both pointed to the Federal Trade Commission, which is already investigating frontier AI firms, as a faster route through unfair and deceptive trade practice rules, though Bailey warned any expansion of that authority would face court challenges.

Florida is investigating OpenAI over the Hugging Face hack, and a nonprofit suing the company has cited California law. Georgetown professor Paul Ohm told a Senate hearing that Congress should not preempt state AI laws, calling states laboratories of democracy.