Article ·
AI Agent Liability: Who Goes to Prison When the Agent Breaks In?
A Senate bill would make the people who run AI agents, and the companies that build them, answer for an agent that hacks, and the evidence of care is becoming the product
Contents11 sections
A bill that names the people behind the agent
When an AI agent breaks into a computer system, somebody is about to be named for it. Under a bill two US senators announced on 1 October 2026, the operator who runs the agent and the developer who built it would both be liable, criminally and civilly. An AI agent is software that uses an AI model to take actions (logging in, calling services, changing records) rather than only answering questions.
The bill's text isn't public, so its wording is unknown.
The direction is clear anyway. Responsibility for an agent's actions is being assigned to people, and those people will be asked to prove they took care. In the same fortnight an insurer and a certifier raised money on exactly that proof. The market has already decided what "reasonable safeguards" will mean in practice.
What was announced
Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) announced the bipartisan AI Agent Accountability Act. Their press release says the bill would hold two groups liable "under the provisions of the Computer Fraud and Abuse Act," the main federal anti-hacking law, usually shortened to CFAA.
- Operators would answer for the "knowing operation of an AI agent that recklessly causes computer hacking damage or loss."
- Developers would answer for "failure to implement reasonable safeguards against hacking" when they knew or had reason to know what the agent could do.
Federal and state attorneys general could also sue for an injunction, a court order to stop. It would reach operators and developers who commit, conspire to commit or attempt a CFAA hacking offence. Murphy said the bill "forces the heads of big AI companies to develop responsibly or face prison time." Hawley put it as an incentive: "With this liability regime in place, AI companies will have every incentive to keep their products safe."
The release stops there.
It carries no bill text and no bill number. It doesn't define "reasonable safeguards," or say which parts of the CFAA would change, and on 21 October I still found no text filed. Everything below about how the bill would work is read from the release and the existing statute, and the text could change all of it.
What the law already says
The CFAA is 18 U.S.C. §1030, and it already reaches people who damage computers without authorisation, recklessly included. Two definitions do most of the work. Damage is "any impairment to the integrity or availability of data, a program, a system, or information." Loss is "any reasonable cost to any victim," which covers responding to the offence, assessing the damage and revenue lost while service was down. Reckless damage is the offence in §1030(a)(5)(B). When it causes one of the listed harms, such as a loss of at least $5,000 in a year, a first offence carries up to five years in prison. That's five times the one-year ceiling on the lesser (a)(5) offences; a repeat offence can reach twenty. Under §1030(g), anyone who suffers damage or loss can also sue for compensation and an injunction.
So a person who recklessly damages a system is already exposed. The bill seems to add two things. One is clarity that running an agent counts as the person's act. The other is a new duty on developers to put safeguards in place once they know their agent could be used to hack. That's the larger change. It moves part of the responsibility from whoever is at the keyboard to the company that shipped the tool.
The market is pricing it already
Two funding rounds landed within a day of each other.
Harbor, a San Francisco company, announced a $10 million seed round on 13 October 2026. It sells risk assessment, risk reduction and insurance to companies that deploy AI agents, aiming to price a liability that existing policies don't cleanly cover. The coverage that announced the round reports no claims history, so there's no evidence yet that its controls reduce losses.
Scarlet, a London company, announced a $50 million Series B on 12 October to build what it calls "a global certification body for advanced healthcare technology companies." It certifies AI-enabled medical devices and says it has cut certification timelines for customers "by a year or more in some cases." The report doesn't say which regulator's regime (UK, EU or US) each certificate falls under.
An insurer and a certifier need the same thing from a customer: evidence that the agent was controlled. Long before a court defines "reasonable safeguards," whoever writes the policy or signs the certificate will.
What reasonable safeguards will likely mean
This section is a reading of likely expectations, and it's neither the bill's text, a court's view nor legal advice. Courts usually judge reasonableness against what careful practitioners already do, how large the risk was, and what was known at the time. On that basis a developer or an operator who wants to show care should expect questions about six layers.
- Scope. The agent reaches only the systems and actions it was granted, by an explicit list (an allowlist) rather than by default.
- Credentials. It holds its own credentials with least privilege, meaning only the access the job needs, and they're short-lived and revocable. It never borrows a person's full login.
- Checks before acting. A request aimed outside the grant is blocked before it's sent, which is a different thing from being reviewed afterwards.
- A record. Every outbound call is logged with who allowed it, in a tamper-evident log that shows any later change.
- A stop. A person can halt the agent at any moment, and the stop is logged too.
- Evidence for outsiders. Tests that try to push the agent past its scope, audit results, certificates and insurance are kept where they can be produced on request.
Two consequences follow from the release's wording. "Knew or had reason to know" means a developer that tests its agent for hacking ability, and finds some, is on notice. The test results then become the reason to add safeguards, and they're no reason to stop testing. Recklessness, for an operator, turns on consciously disregarding a known risk. An operator who points a capable agent at the open internet with broad credentials and no limits is the case the bill seems written for.
Healthcare runs on other people's systems
Healthcare agents touch electronic health records, insurers' portals, pharmacy systems and devices, and nearly all of them belong to somebody else. Each becomes "someone else's system" in CFAA terms the moment an agent reaches past what it was granted. A scheduling agent that tries a login it was never given would now carry a name. So would a records agent that follows a link into another organisation's record.
What it means for MARA
MARA, the Medical Agentic Resident Assistant this project is designing, already works inside those lines. She runs with least privilege and scoped credentials, and she has no access outside her grant. Her methods are proved first in MAX4, the desktop generation of the MAX AI resident. Before she inherits them, MAX4 has to show two things: its agents can't reach hosts outside an allowlist, and every outbound call is logged, with who allowed it, in a tamper-evident record.
The bill changes nothing in that design. It makes the record of it worth keeping.
What isn't known yet
The bill's text, number and definitions aren't published. Nobody knows whether "reasonable safeguards" will be defined in the bill, left to the courts, or tied to an outside standard. Harbor's and Scarlet's figures are the companies' own, and their policy terms and certification regimes weren't checked. Nothing here is legal advice.
Why it matters
Until now an agent that wandered into the wrong system was an engineering incident. Under this bill it becomes a question with a defendant, and the answer will turn on paper: the allowlist, the credential policy, the log, the record of the stop button being pressed. A company that can't produce those will find out what "reasonable" meant from a prosecutor. A company that kept them will hand them to its insurer first — which is why the insurers and certifiers are already raising money.
Sources
- Office of Senator Josh Hawley. "Senators Hawley, Murphy announce bipartisan AI Agent Accountability Act." Press release, 1 October 2026, opened 21 October 2026. https://www.hawley.senate.gov/senators-hawley-murphy-announce-bipartisan-ai-agent-accountability-act/
- 18 U.S.C. §1030, Fraud and related activity in connection with computers, via the Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/18/1030
- Dealroom. "Harbor lands $10M seed to insure the AI agent liability gap." 13 October 2026. https://dealroom.co/news/162200-harbor-lands-10m-seed-to-insure-the-ai-agent-liability-gap/
- Pulse 2.0. "Scarlet raises $50 million in Series B funding to expand AI medical device certification platform." 12 October 2026. https://pulse2.com/scarlet-raises-50-million-in-series-b-funding-to-expand-ai-medical-device-certification-platform/
- Digital Policy Alert. "AI Agent Accountability Act," status entry dated 1 October 2026, listing no bill number. https://digitalpolicyalert.org/change/22003-ai-agent-accountability-act
Glossary
| Term | Definition |
|---|---|
| AI agent | software that uses an AI model to take actions, such as logging in, calling services or changing records. The bill is about what happens when those actions reach a system they shouldn't. |
| Allowlist | an explicit list of what's permitted, with everything else refused. It's the simplest way to prove an agent's scope. |
| CFAA (Computer Fraud and Abuse Act): 18 U.S.C | §1030, the main US federal anti-hacking law. The bill would apply its provisions to agent operators and developers. |
| Damage | under the CFAA, any impairment to the integrity or availability of data, a program, a system or information. It's one of the two harms that trigger liability. |
| Developer | the company that builds and supplies an agent. The bill would make it answer for missing safeguards once it knew what the agent could do. |
| Injunction | a court order to do, or stop doing, something. The release lets federal and state attorneys general seek one. |
| Least privilege | giving a system only the access its task needs. It limits what an agent can damage when it goes wrong. |
| Loss | under the CFAA, any reasonable cost to a victim, including response, assessment and revenue lost to an outage. A loss of $5,000 in a year is one of the thresholds for the higher penalty. |
| MARA (Medical Agentic Resident Assistant) | this project's design for a clinical assistant that recommends while a person decides. Her access rules are the kind of safeguard the bill would reward. |
| MAX4 | the desktop generation of the MAX AI resident, from October 2026 on, where MARA's methods are tested first. |
| Operator | the person or organisation that runs an agent and directs it. The bill would make it answer for an agent that recklessly causes damage or loss. |
| Reckless | acting while consciously disregarding a substantial, known risk. It's the standard the bill applies to operators. |
| Tamper-evident log | a record built so that any later change can be detected. It's the evidence an insurer, a certifier or a court would ask to see. |
Related
Related field notes
Keep reading
More field notes
This piece is part of the MAX Research Collective library. Browse the rest, or connect on LinkedIn.