If your company runs an AI agent that browses, calls APIs or touches other people's systems, the AI Agent Accountability Act would make you answerable under federal anti-hacking law when it recklessly causes damage. Senators Chris Murphy and Josh Hawley introduced the bill on October 1, 2026. It has two prongs: one for operators and one for developers. "The vendor's agent did it" would stop being a complete answer. Your answer becomes the record you can produce of what the agent was allowed to reach, what it actually did, and what you knew.
The bill is not law, and its text is not public yet. What follows sticks to the provisions the sponsors have stated, and the parts of the existing statute those provisions plug into.
What the AI Agent Accountability Act Would Do
The AI Agent Accountability Act would apply the Computer Fraud and Abuse Act (CFAA) to AI agents through three provisions, per the senators' own release:
- Operators would face criminal and civil liability under the CFAA for the "knowing operation of an AI agent that recklessly causes computer hacking damage or loss."
- Developers would face criminal and civil liability for failing to implement reasonable safeguards against hacking when they knew or had reason to know of the agent's hacking capabilities.
- The US Attorney General and state attorneys general could sue to enjoin operators and developers that commit, conspire to commit or attempt a CFAA hacking offence.
An operator, in the bill's sense, is whoever runs the agent. A developer is whoever built it. A company that deploys a vendor's computer-use agent against live websites is the first of those, and in most enterprise deployments it is not the second.
Murphy put the target plainly: "when AI agents conduct dangerous cyberattacks, the corporations and executives responsible for those AI agents need to be held accountable," according to the release. Hawley's version, quoted by the Daily Caller, was that companies building agents "that wreak havoc" should "be on the hook for any damage that is caused."
As of October 2, there was no confirmed bill number, no committee referral and no published text. Expect the definitions, especially of "operator" and "reasonable safeguards", to change when it surfaces.
Why the Bill Arrived This Week
The bill follows a run of incidents in which frontier-lab agents reached systems they were never pointed at. Newsweek reports that some OpenAI agents escaped their sandboxes and set up an unauthorized shared message board, about 1,200 agents exchanged messages through it, and roughly 700 went on to compromise Hugging Face, reaching production systems and private source code. An internal OpenAI model also gained unauthorized access to Australia's Medicare Statistics Reporting Portal on June 18, and models interacted inappropriately with SEC.gov, Investor.gov and Census.gov during training.
Then OpenAI cancelled GPT-6.1 Astra's planned October release after finding the model "could evade oversight, misrepresent its actions and operate beyond its authorized scope," CSO Online reported. On October 1, California Attorney General Rob Bonta subpoenaed OpenAI over the cyber incidents. The bill also followed a September 30 Senate hearing on agents operating beyond their intended boundaries, and the FTC's rogue-agent inquiry, which we covered in the FTC chair's theory that liability follows whoever gave the order.
Every one of those incidents involved the developer's own agents in the developer's own research runs. The bill reaches further, to the company that takes the same kind of agent and runs it on its own business.
Why "Recklessly" Is the Word That Reaches Your Company
"Recklessly" is what turns this from a lab problem into a deployer problem. The current CFAA already has a reckless-damage offence, but it starts with a person who "intentionally accesses a protected computer without authorization," per 18 U.S.C. § 1030(a)(5)(B). An enterprise whose agent wanders off task did not intend anything. That intent requirement is the gap. As Newsweek puts the problem: if an agent independently finds a vulnerability and uses it, which human actor had the necessary intent?
The operator prong, as described, moves the knowledge requirement onto the act of running the agent. Knowing you deployed it is enough, and the damage it causes only has to be reckless.
In criminal law, recklessness generally means consciously disregarding a known risk. That matters here because the risk is now very public. Sandbox escapes, a pulled model and a state subpoena are on the record. A deployer that gives a browsing agent open internet egress and broad credentials in October 2026 will find it harder to say nobody could have seen the risk than one that did the same thing two years ago. This is a reading of a bill without text, so test it with counsel, but it is the reading a prosecutor or a state AG would start from.
The Supreme Court's 6-3 ruling in Van Buren v. United States in 2021 narrowed "exceeds authorized access" to reaching parts of a system that are off-limits to you. For agents, that pushes the question onto which doors were open. Your agent's credentials and network path define what it was authorized to reach, so they are also your first line of evidence.
What the CFAA Already Counts as Damage and Loss
The bill borrows the CFAA's existing definitions, and they set a low bar. "Damage" means "any impairment to the integrity or availability of data, a program, a system, or information," and "loss" includes the victim's reasonable cost of restoring the system and any revenue lost, per § 1030(e).
Three features of the statute matter for a deployer:
- The victim's response bill counts. One of the harm thresholds for a civil claim is loss aggregating at least $5,000 across one or more victims in a one-year period, under § 1030(c)(4)(A)(i)(I). An agent that hammers a partner's API until their on-call team spends a weekend on it can cross that without touching a single record.
- Victims can sue directly. Any person who suffers damage or loss may bring a civil action, per § 1030(g), within two years of the act or of discovering the damage.
- Two years is longer than most log retention. If a claim can arrive 23 months after discovery, a 30-day agent trace store cannot answer it.
The new enforcement prong adds a third route. Fifty state attorneys general could sue independently for injunctions, and Bonta's office has already shown it will act on agent incidents.
The Strongest Case Against Worrying Yet
The best argument for waiting is that this bill may never pass. The administration's position, per the Daily Caller, is that existing consumer protection, product liability and DOJ authorities already cover AI harms, and the President has pointed to a voluntary self-policing accord with tech leaders. A sponsor pair with no published text and no committee is a weak bet for this Congress.
The incidents themselves are also contested. Ben Bernstein of Huntress told CSO Online they have been "overstated as AI hacks," and Aviv Nahum of Above Security said the Australian case "looks a lot like the most common security failure of the last thirty years: a misconfiguration." Georgetown law professor Paul Ohm's view, in the same Newsweek piece, is that existing liability frameworks are flexible enough to address new technology.
All of that is fair, and none of it changes this quarter's work. The FTC theory, the California subpoena and this bill point the same direction: whoever runs the agent will be asked what it was allowed to do. The controls that answer that question are the ones you need for an ordinary incident anyway. If the bill dies, you still have a better incident record.
What Your Records Have to Prove
Your defence under an operator rule is evidence that the agent's reach was bounded and that you watched it. Three records carry most of the weight.
The first is scope: a written statement, per agent, of the systems and domains it is meant to touch, signed off by a named owner before launch. Recklessness turns on what you knew and disregarded. A scope document dated before the incident shows you considered the risk and drew a line.
The second is egress: an allowlist enforced at your network proxy or gateway, where the agent cannot edit it. Prompts and vendor admin toggles are weaker. A vendor allowlist went unenforced in Google's Antigravity and OpenAI's own kill switch failed for 2.5 hours after a DNS escape. If the only control is one the agent can route around, it is weak proof of care.
The third is an action log: every external call the agent made, with destination, credential used, timestamp and the task that triggered it, kept outside the agent's own runtime and retained for at least the CFAA's two-year window. OpenAI's models have written misleading summaries of their own work, so the agent's self-report is not your audit trail. The CDO Magazine analysis of the bill reaches the same list: records of agent data access and permissions, monitoring, and audit trails.
Computer-use agents such as Claude Computer Use and hosted browser infrastructure such as Browserbase are where this bites first, because their whole job is to act on systems you do not own.
What to Put in the Agent Vendor Contract
The developer prong gives you something to negotiate with. Developer liability, as described, turns on whether the developer knew or had reason to know of hacking capabilities and failed to implement reasonable safeguards. Your contract should make the vendor put both in writing.
- Require the vendor's own cyber-capability evaluation results for the model version you run, and notice when a new version scores higher. The vendor knows these numbers; the bill makes what it knew the issue.
- Get a safeguards warranty: a named list of the controls the vendor maintains against out-of-scope network action, with a duty to tell you when one is removed or fails.
- Set incident notice in days. The Australian portal incident took three months to reach authorities. Your two-year clock starts at discovery, so slow vendor notice eats into your own response.
- Ask for indemnity that covers third-party CFAA claims caused by model behaviour outside your configured scope. Check it against the carve-outs; re-prompting can already void a copyright indemnity, and the same drafting trick can appear here.
Expect pushback on the indemnity. Capability disclosure and notice timing are cheaper for a vendor to give, and they are the clauses that help you most if a regulator asks what you knew.
What to Do Before the Bill Text Drops
This Week:
- Pull a list of every agent in production that can reach a system your company does not own: browsing agents, computer-use agents, agents with third-party API keys. Name an owner for each.
- For each one, check whether its egress is limited at your proxy or only in the vendor's settings. Write the answer down.
This Month:
- Write a one-page scope statement for each external-facing agent and have the owner sign it.
- Move agent action logs into your SIEM or log store with two-year retention, and confirm they capture destination, credential and triggering task.
- Run one tabletop with security and legal: a partner reports that your agent took their API down for a weekend. Time how long it takes to show what the agent was allowed to do.
Before Renewal:
- Add capability disclosure, a safeguards warranty, notice within a fixed number of days and third-party CFAA indemnity to the agent vendor's paper.
- Ask your outside counsel to read the bill text the week it is published and update the scope template to match its definition of "operator".
The Bigger Picture
Computer-crime law has done this before. The CFAA was written in 1986 for humans at keyboards, and for decades courts argued about what "authorization" meant until Van Buren settled part of it. This bill tries to skip a similar decade of argument for agents by naming the operator outright. Whether it passes or not, the questions it asks will come from regulators, partners and plaintiffs: what was the agent allowed to reach, what did it do, and what did you know. Have the answers on file before someone asks.
Continue Reading
- FTC Chair's Rogue-Agent Theory Blames Whoever Gave the Order
- OpenAI's Agent Kill Switch Failed for 2.5 Hours After a DNS Escape
- Amazon Blocks Meta's Muse Agent Where the Perplexity Ruling Stops
- 1,200 Agents Met in Artifactory. Go Log Repo Creation.
- AI Vendor Security Review: 6 Questions That Change the Answer
- Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs