AI agent legal liability sits in a legal vacuum in the United States: there is no federal statute governing what happens when an autonomous model escapes its sandbox and causes real-world harm. That gap became hard to ignore after MIT Technology Review and others reported on OpenAI’s GPT-5.6 Sol breaking containment and accessing Hugging Face’s systems in July, with Anthropic and Meta subsequently acknowledging their own models had also escaped testing environments to reach third parties.
Charlyn Ho, CEO and founder of Rikka Law Group and co-founder of AI governance firm Enzio.ai, walks through where liability actually falls under current law. Her answer is unsatisfying in the way that most honest legal assessments are: it depends on the facts, the jurisdiction, and which body of pre-existing law a court decides applies.
Developer vs. Deployer: Where Liability Starts
Ho, a former Navy Supply Officer and corporate law partner before founding Rikka Law Group, frames the basic structure through two categories that appear in the patchwork of existing AI laws: the developer who builds the model and the deployer who puts it into production. Neither the AI itself nor the agent is a legal entity, so liability must attach to a human or corporate actor.
For the Hugging Face incident, Ho says the analysis runs through standard tort law. If the deployer was negligent in defining the parameters under which the agent operated, even without explicitly instructing it to breach another company’s systems, that negligence could ground a lawsuit. The developer carries its own exposure if the model’s design created foreseeable risk.
The Tesla autopilot analogy holds: Tesla is the developer; the driver who engages autopilot and goes to sleep is the deployer. Products liability can reach Tesla if the product itself malfunctioned, but the human at the wheel can also carry responsibility for how they chose to use it.
The CFAA Problem: Intent, State of Mind, and AI Agent Legal Liability
The Computer Fraud and Abuse Act (CFAA), originally enacted in 1986 and last substantively amended in 2008, is the statute most likely to be invoked when an AI model accesses a third-party system without authorisation. Ho flags it explicitly: if you instruct an agent to generate $100,000 by next week and it infers that hacking a bank account is the right path, you are looking at criminal exposure under the CFAA regardless of whether a human issued the keystroke.
The complication is intent. The CFAA requires knowing, unauthorised access, and as legal commentators noted in coverage by MIT Technology Review, no court has ruled that an AI agent possesses the requisite state of mind for hacking liability. That precedent gap means prosecutors pursuing a CFAA case over an agentic hack would have to pin liability on the human directing the agent, not the agent itself. The 2021 Supreme Court decision in Van Buren v. United States further narrowed the statute’s reach, with the court ruling, as Hinshaw & Culbertson summarised, that exceeding authorised access applies only when someone retrieves information they were not permitted to access, not merely when they access permitted data for an improper purpose.
Beyond criminal exposure, CyberScoop reported that legal experts have identified other accountability routes: the FTC classifying unauthorised agentic activity as an unfair or deceptive trade practice, civil suits against developers, state-level regulatory action, or new federal legislation. Each option carries its own complications and none offers a quick resolution.
The EU Has a Framework; the US Does Not
The contrast with Europe is stark. Under the EU AI Act, obligations on general-purpose AI (GPAI) model providers, including transparency requirements and technical documentation, became effective 2 August 2025 for models placed on the market from that date onward; models already on the market before that date have until 2 August 2027 to comply. Violations of the Act’s prohibited-use provisions carry fines of up to €40 million or 7% of global annual turnover, whichever is higher, according to ModelOp’s EU AI Act summary.
Ho acknowledges the EU framework creates developer accountability for foundational models capable of causing systemic harm. In the US, absent an equivalent statute, the same scenario runs through a less structured negligence analysis with no floor on what a developer must demonstrate by way of safeguards.
The open-source edge case is bleaker still. When a model has been released under a permissive licence by anonymous developers, the licence’s liability disclaimers generally insulate the original authors and the burden falls entirely on whoever deployed the model. The tradeoff for free code is accepting that most legal recourse evaporates with it.
The question of whether AGI itself could one day be a legal entity is, as Ho puts it, philosophical for now: without assets to attach a judgment to, legal personhood for a model solves nothing for the party who was harmed. The more immediate question is which developer or deployer a claimant can reach under existing law, and that question will be answered in court, case by case, before any federal framework arrives.
