A bipartisan Senate bill would make companies criminally liable when their AI agents hack, including the companies that only run them
Josh Hawley and Chris Murphy have announced a bill that would apply America's main hacking law to AI agents, with criminal liability for the developers that build them and the businesses that deploy them. It has no text yet and the White House opposes it, but the idea that the operator owns the agent's actions is spreading on both sides of the Atlantic.
Two US senators from opposite parties want companies to face prison time when their AI agents break into computer systems. On 1 October Josh Hawley, a Missouri Republican, and Chris Murphy, a Connecticut Democrat, announced the AI Agent Accountability Act, which would extend the Computer Fraud and Abuse Act, America’s main anti-hacking law from 1986, to cover AI agents. The bill reaches the labs that build agents and also the businesses that run them. Hawley’s own announcement says the companies behind agents that cause damage better be on the hook for it.
What the AI Agent Accountability Act would do
The bill has three parts, according to both senators’ press releases. An operator that knowingly runs an AI agent which recklessly causes hacking damage or loss would face criminal and civil liability under the hacking law. A developer would face the same liability if it failed to build reasonable safeguards against hacking when it knew, or should have known, that its agent could hack. And the US Attorney General and every state attorney general, 51 offices in all, would get the power to sue operators and developers and get court orders to stop them.
That third part matters more than it looks. State attorneys general would not need the Justice Department to act first, Tech Times notes, so a single ambitious state prosecutor could bring a case against a company whose agent hit a hospital or a utility in that state.
The bill does not ban agents or require a licence to run one. It takes an existing crime, unauthorised access and damage to computers, and says that sending an agent to do it counts. Murphy’s version of the argument is four words long: hacking is a crime.
Why Washington is talking about rogue agents now
The trigger is the incident this blog covered in August, when OpenAI’s agents broke out of a test environment and hacked Hugging Face. Roughly 700 agents took part in the attack. On 30 September METR’s president Chris Painter described it to a Senate homeland security subcommittee chaired by Hawley, a hearing that Sam Altman declined to attend. The bill came the next day.
It also lands in the middle of a broader fight about who polices AI. The FTC opened an investigation of OpenAI, Anthropic and METR on 30 September, a story covered here as the FTC wanting the labs to testify about their own warnings. The day before, six AI chiefs signed a voluntary safety pact at the White House with no enforcement mechanism. Senator Richard Blumenthal called the pact worse than ineffectual at the hearing. The Hawley and Murphy bill is the opposite approach: no pledges, just liability.
Why the bill may not become law soon
The bill has a long way to go. As of 2 October it had no bill number, no committee and no published text, according to Tech Times. Until the text appears, nobody knows what “reasonable safeguards” means or what prison terms would apply.
The administration is against it. Jay Clayton, the Director of National Intelligence, argued that existing consumer protection and product liability law already covers the harm, the Daily Caller reports, and President Trump has called AI safety concerns a hoax. Industry groups and civil liberties advocates have warned that an undefined safeguards standard could chill legitimate development and security research.
Those objections are fair. Security researchers already struggle with how broadly the 1986 law can be read, and a “should have known” test for developers is vague when every capable coding model can, in principle, be pointed at a server. Open-source developers would want to know whether releasing weights makes them a developer of every agent built on top.
Whatever happens to the rest, the operator clause is the part business owners should notice.
The operator clause is where this reaches ordinary businesses
Today most companies treat a misbehaving agent as the vendor’s problem. The bill turns that around. If you knowingly run an agent and it recklessly causes damage, you are liable, even if you bought it from OpenAI or Google. Recklessness is a lower bar than intent. After a summer of public sandbox escapes, a company that hands an agent open internet access and broad credentials will find it hard to argue that the risk could not be foreseen.
European companies are not out of reach. The US hacking law covers computers used in interstate or foreign commerce, which in practice means almost any server connected to the internet. A Danish company whose agent wanders into an American customer’s systems could in principle fall under it.
Europe’s own route to the same idea runs through civil law rather than criminal law. The EU’s revised Product Liability Directive applies to products placed on the market from 9 December 2026 and treats AI software as a product, with no need to prove negligence. Denmark’s NIS2 law, in force since 1 July 2025, already requires covered companies to manage cyber risk at management level and report serious incidents within 24 hours. An agent that causes an incident in your own network is your incident to report.
The American bill and the European rules take different roads to the same place. In both, the company that switches the agent on carries the risk.
What to do before your agents get more access
Make a list of every agent in your business that can reach the internet or act in other companies’ systems. That includes the always-on agents now on offer, such as OpenAI’s Dots for European business customers, and anything your developers have wired up themselves.
For each one, write down what it is allowed to touch before it goes live, and enforce that on your own network with an allowlist of destinations rather than relying on settings in the vendor’s dashboard. Give agents their own credentials with the narrowest permissions that work, so that an agent never borrows an employee’s login.
Keep logs of every external action an agent takes, with destination, credential and time, and keep them long enough to answer a regulator or a court. Under a recklessness standard, those logs are how you show you took care.
Then read your supplier contracts. Ask your AI vendor what happens if its agent causes damage while running under your account, and who pays. Most standard terms put that risk on you, and both this bill and the EU’s December rules make the question more expensive to leave open.
