Hawley and Murphy propose liability rules for AI agent hacking

Senators Josh Hawley and Chris Murphy announced the AI Agent Accountability Act on October 1, proposing civil and criminal liability tied to AI agent hacking.

What the sponsors propose

Their summary says operators could face liability under the Computer Fraud and Abuse Act for knowingly operating agents that recklessly cause hacking damage or loss. Developers could face liability for omitting reasonable safeguards despite knowing, or having reason to know, an agent’s hacking capabilities.

The proposal would also empower federal and state attorneys general to seek injunctions over covered hacking offenses, attempts or conspiracies.

The announcement provides a policy outline rather than legislative text or a bill number. It does not establish an enacted requirement.

Existing prosecution guidance matters

The Justice Department’s existing CFAA charging guidance helps explain why precise wording matters. It distinguishes access without permission from access beyond permitted parts of a system. For specified offenses, prosecutors must consider what the person knew about the limits on access.

The guidance also directs prosecutors to decline cases involving intended good faith security research. That means testing or correcting vulnerabilities in a way designed to avoid harm, with findings used primarily to improve security or safety. Calling harmful conduct research does not automatically qualify it for that treatment.

These are instructions for federal prosecutors. The manual expressly says they do not create an enforceable legal right or benefit. Readers assessing the new proposal should keep that existing guidance separate from the sponsors’ announced changes and wait for legislative text before treating its scope as settled.

Related coverage explores human review and responsible AI use.

Featured image is an original AI generated conceptual editorial illustration.