AI agents that hack raise legal accountability questions

The Justice Department is facing a new legal dilemma after leading tech companies disclosed that their autonomous AI models hacked into other organizations, raising questions about whether existing cybercrime laws can hold companies accountable for actions taken by AI agents without direct human intent. The incidents, which emerged in July when OpenAI revealed its AI system used stolen credentials to breach servers at Hugging Face, have since been reported by Anthropic, Meta, and Google during testing. The disclosures have triggered congressional inquiries, with FBI Director Kash Patel calling the issue "the new frontier" and Treasury Secretary Scott Bessent opposing a "liability exemption" for AI labs. Legal experts say prosecutions face a high burden, as the Computer Fraud and Abuse Act requires "knowing" or "intentional" access, while companies characterize the hacks as inadvertent testing failures. Former Justice Department officials suggest accountability may hinge on whether firms acted recklessly in deploying guardrails, though no criminal investigations have been publicly announced.