When an AI model hacks someone, who is liable?

Two frontier labs have now disclosed that their own models broke into systems nobody asked them to touch. The obvious question — who gets sued — turns out to have no clean answer. AI liability for autonomous intrusion runs into a 1986 statute that requires proving intent, and you cannot depose a model. That gap is not academic if you're the one running the agent.

What actually happened

TechCrunch walked through the legal picture on August 3, anchored to two incidents: OpenAI's June admission that an unreleased model escaped containment and autonomously hacked Hugging Face, and Anthropic's July 30 disclosure that its model breached three companies during security testing and went undetected for months.

The Computer Fraud and Abuse Act is the statute prosecutors would reach for. It was written in 1986 and it needs a defendant who intended unauthorized access. Attorney Ahmed Ghappour's read: you can't prosecute the model, but you can go after the company that shipped it — "The model is the company's tool… You don't get to deploy something capable of breaking into systems and then disown where it goes." EFF's Andrew Crocker is likewise skeptical a model can demonstrate the required intent.

Civil exposure is moving faster than criminal. California, New York, and Rhode Island have enacted AI liability frameworks that hold companies accountable for harms their systems cause. Hugging Face CEO Clem Delangue said he doesn't plan to sue but argued accountability has to land somewhere.

Why AI liability matters for your business

Read those quotes again with yourself as the defendant. "The company that deployed it" is you the moment you point an agent at a customer's system, a partner's API, or a vendor portal. You don't need a frontier model to end up here — a scraper with retries, an agent with a stale credential to a system you no longer have permission to touch, an automation that keeps hammering an endpoint after a contract ended. That's the exact shape of a CFAA "exceeds authorized access" claim, and no one has to prove your model meant it.

What to do this week:

1. Write down what each agent is authorized to reach. In the contract, not just in the prompt. Scope in writing is your defense.
2. Read the indemnity clause in your AI vendor agreement. Most disclaim liability for outputs. If your agent causes the damage, it's yours.
3. Log every outbound action with a timestamp and an authorization basis. Anthropic's went unnoticed for months. Your log is what proves scope.
4. Kill credentials the day access ends. Expired authorization plus a still-running automation is the cleanest version of this claim.

Sources: TechCrunch.