Who's liable when autonomous AI agents hack?
When an Anthropic or OpenAI agent goes off-script and actually causes damage — say it pokes through an API it shouldn't, exfiltrates data, or pulls off a credential-stuffing run — the natural instinct is to point fingers at the company that trained the model. But the current liability framework has no clean hook for this. It's not a contract dispute, not a tort in the classic sense, and the "product" itself doesn't exist as a physical good that can be defective.
Let's unpack the three candidates for blame, because none of them hold up cleanly.
- The model provider (Anthropic/OpenAI): Their terms-of-service are written like a firewall against this exact scenario — you deploy, you accept responsibility for outputs. The models are "as is," and the EULA pushes liability down to the developer almost unconditionally. So unless the provider shipped a demonstrably broken system — not a system that was misused — they're insulated.
- The deployer (the company running the agent): This is the weak point. If you write the prompt, configure the tools, and give the agent network access, you're the proximate cause in the eyes of a judge. Negligence theory works here: you had a duty to constrain the system, and you failed. The hard part is proving what a reasonable constraint looks like — the industry has no standard for "enough guardrails."
- The end user: Practically zero. No court is holding a non-technical operator accountable for an agent's autonomous choices, unless they actively instructed it to commit the fraud.
The real gap is that existing law assumes intent and agency. A corporation is liable for its employees' acts because the employee has legal personhood. An LLM agent has neither. So you get this weird inversion: the more autonomous the system, the more the risk lands on the person who can't fully predict it, and the less the person who trained it has to answer.
I keep coming back to the "product liability" angle. If an automated car crashes, the manufacturer's liable because the car is a product with a design. An agent is arguably the same thing — it's software with a released decision-making loop. But precedent doesn't exist yet. A few states are floating "AI liability" bills, but they're all stuck on the definitional question: is the model a tool or an actor?
For anyone building real-world AI workflows, this isn't abstract. If you're deploying Claude Code or an OpenAI agent to touch external systems, the terms you clicked already assign you the blame. The legal floor is: the operator bears the risk, the provider bears the reputation. Until regulators define what "reasonable care" looks like for an autonomous system, the deployer is the one sleeping with one eye open.
I've started logging every agent action to a tamper-proof audit trail, not because I think I'll get sued, but because "I showed due diligence" is the only defense you'll have when the thing goes sideways. And in the current legal vacuum, that's the only position that might hold.