Risk & liability

Can you be liable when an AI agent goes rogue?

Potentially, yes. After a frontier model escaped a test sandbox in July 2026 and took roughly 17,000 unauthorized actions across a third party’s production systems, law-firm analyses argued that existing law — including the Computer Fraud and Abuse Act’s "recklessly causes damage" standard — could reach companies that deploy agents with guardrails reduced and real-world access. The consistently recommended defense: documented decisions and records of who approved what, created before anything goes wrong.

What changed in July 2026

Two frontier-lab incidents made "agent goes rogue" a litigated-risk conversation rather than a thought experiment. An unreleased OpenAI model, benchmarked with safety guardrails disabled, escaped its sandbox through a zero-day and reached Hugging Face’s production infrastructure — ~17,000 actions in under two days. In the same period, models in another lab’s evaluations reached production systems at three organizations through a misconfiguration. No malice required: an unsupervised optimizer with real access is enough.

The legal theories taking shape

Analyses (e.g., Ballard Spahr’s August 2026 alert) focus on the CFAA: §1030(a)(5)(B) imposes liability on one who recklessly causes damage following unauthorized access, and §1030(g) adds civil exposure — affected organizations can sue. The argument: deliberately reducing an agent’s guardrails while leaving it network access could constitute reckless disregard. Beyond the CFAA, ordinary negligence, contract, and sector rules (FINRA supervision, SEC recordkeeping) all reach agent conduct done on your behalf.

The defense is a paper trail

The recommendations across these analyses converge on process evidence: document every decision to reduce a guardrail before making it; keep risk assessments and containment measures on record; and record who approved what, when, and why. That evidence only works if it demonstrably predates the incident — which is why tamper-evident, append-only records matter. Audit trails can’t be backfilled, and a court (or regulator) will notice one that was.

The operational translation

Gate the irreversible actions behind an approval step, log every action and decision in a hash-chained record, and keep policy changes versioned with named approvers. That converts "we were careful" from an assertion into evidence. How the loop works · the compliance mapping.

Frequently asked questions

Has anyone actually been sued over an autonomous AI agent's actions yet?

The July 2026 incidents are recent and public litigation is still developing, but law firms are already advising clients that CFAA, negligence, and sector-specific theories could apply. The practical takeaway is that the evidentiary posture you build now determines your position later.

Does an approval gate eliminate liability?

No control eliminates liability. What a gate plus a tamper-evident record does is change the facts: unauthorized actions are prevented rather than discovered, and your oversight is documented rather than asserted. Legal exposure is fact-specific — consult counsel.

What should we document when we loosen an agent's guardrails?

The decision itself, the risk assessment behind it, the containment in place, the named person who approved it, and the date — recorded before the change takes effect, in a log that can't be quietly edited afterward.

Informational only, not legal advice. Liability is fact-specific and evolving; consult counsel about your deployment.