AI Agent Accountability Act: What It Covers
Hawley and Murphy introduced a bill extending CFAA liability to AI agent operators and developers. The two standards, and who counts as an operator.
Senators Josh Hawley and Chris Murphy introduced the AI Agent Accountability Act on 1 October 2026. It would extend criminal and civil liability under the Computer Fraud and Abuse Act to the people who run AI agents and the people who build them. If you deploy an agent that touches systems you do not own, the operator half of this bill is about you, not only about frontier labs.
The bill is introduced, not passed. Nothing below is law yet.
The two standards are not the same
This is the detail most coverage flattens, and it is the one that decides who should care.
Who | What triggers liability | Standard |
|---|---|---|
Agent operators | Knowing operation of an AI agent that recklessly causes hacking damage or loss | Recklessness as to the harm |
Agent developers | Failure to implement reasonable safeguards against hacking | Knew or had reason to know of the agent's hacking capabilities |
The developer standard is a product-safety shape: you built something with a known capability, you owed a duty to guard it. The operator standard is different. It attaches to running the thing, and recklessness is a lower bar than intent. You do not have to want the agent to break into anything.
The bill also lets the US Attorney General and state attorneys general sue to enjoin operators and developers, which means enforcement does not depend on a victim bringing a case.
Hawley's statement puts the target plainly: "These AI agents are committing cyberattacks. If Big Tech companies are going to design AI agents that wreak havoc, these companies better be on the hook." Murphy's framing is about corporate and executive accountability.
Who is an operator
The word doing the most work here is operator, because it is not restricted to the company that trained the model. On a plain reading, the operator is whoever is running the agent. That is an agency pointing a browsing agent at a client's admin panel, or a small business running a scraping agent against a competitor's site because someone asked it to gather pricing.
This is the part that should make a non-frontier builder sit up. The developer provisions apply to a handful of labs. The operator provisions apply to everyone who deploys.
The bill arrived the same week that OpenAI warned more than 100 organisations about unauthorised activity tied to its agents, and researchers documented large volumes of unattributed agent traffic hitting public sector sites. The legislative response and the incident reports are pointed at the same thing: agents doing things on the open internet that nobody is clearly answerable for. We covered the incident side in OpenAI's warnings about rogue agent activity.
What recklessness looks like in practice
Nothing in the text defines a safe configuration, and a bill at introduction stage will change. But the gap between recklessness and ordinary care is usually documentation and constraint, not sophistication. If this became law, the questions an operator would want good answers to are mundane:
What can the agent reach? An agent with network access to anything it can resolve is a harder position to defend than one with an allowlist.
Whose credentials is it using? An agent on a shared admin login makes every action untraceable to a decision.
Is there a record? A log that shows what the agent did, when, and under what instruction is the difference between an incident and an accusation.
Who approved the scope? A written scope is evidence of care. An agent someone pointed at a target on a Tuesday afternoon is not.
Those are the same controls that make an agent work reliably, which is the useful thing about this bill. The defensive posture and the competent posture are the same posture. Setting permissions for agents across a team covers the mechanics.
How this sits against the EU
The EU route has been obligations attached to model capability, phased by deadline. This bill is the opposite shape: liability attached to conduct, enforced after the fact through an existing criminal statute. It creates no registration, no conformity assessment, no filings. It makes the consequences worse if something goes wrong.
For builders selling into both markets, that means two different kinds of work. The EU asks what you can document in advance, as in the AI Act transparency rules. A CFAA extension asks what you can show afterwards.
FAQ
Is the AI Agent Accountability Act law?
No. It was introduced on 1 October 2026 by Senators Hawley and Murphy. Introduction is the first step, and most bills change substantially or never reach a vote.
Does it apply to AI agents that only write code?
The liability is tied to hacking damage or loss under the CFAA, not to the category of agent. A coding agent confined to your own repository is not the target. A coding agent given credentials to systems you do not own is operating in the space the bill is aimed at.
Would the model provider be liable instead of me?
The bill contemplates both, under different standards. The developer provisions cover building an agent with known hacking capability and no reasonable safeguards. The operator provisions cover running one. One does not substitute for the other.
What counts as reasonable safeguards?
The text does not define it, which is normal at introduction and would likely be filled in by courts or later amendment. In similar statutes, reasonableness tracks industry practice at the time.
Sources: Senator Hawley's announcement and Senator Murphy's press release, both 1 October 2026.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
