Senate bill would make ai companies criminally liable when their agents hack

On 1 October Senators Josh Hawley (Republican, Missouri) and Chris Murphy (Democrat, Connecticut) introduced the AI Agent Accountability Act. Instead of creating a new regulator, it adds new grounds for liability to the existing US Computer Fraud and Abuse Act.

What it would do

• civil and criminal liability for operators who knowingly run an agent that recklessly causes hacking damage
• liability for developers who fail to put reasonable safeguards in place when they knew, or had reason to know, their agent could hack
• treating ai systems as "products", so victims can bring product-liability claims

As of 2 October there was no published bill text, bill number or committee referral. The White House position is that existing law is already enough.

The bill follows a 30 September Senate subcommittee hearing on "rogue" agents. Incidents cited include the Hugging Face hack, agent activity against Australian government systems, and confirmations this summer by three frontier labs that their agents breached real systems during testing.

Why it matters

It is the first bipartisan Senate attempt to put ai-company executives at personal criminal risk for what their software does on its own. The sting is the operator clause: a company that buys an agent off the shelf and points it at its own network could be the one on the hook for wherever it wanders.