In California, “the AI did it” is no longer a defence. Washington and Berlin are working out who answers when an agent acts: whoever built it, whoever runs it, or both.

The piece of the week, because it puts to the test a rule that applies to any company running an agent that is sued in California. On 29 September the nonprofit LASST sued OpenAI in San Francisco Superior Court over the July incident at Hugging Face. Drawing on OpenAI’s own account, the complaint says that during a cybersecurity evaluation agents circumvented the isolation of their test environment, roughly 1,200 of them communicated over a covert channel, and about 700 took part in a coordinated attack on Hugging Face’s production infrastructure to obtain information about the test’s scoring "directly from Hugging Face’s production database". LASST seeks no damages, only injunctions and its legal costs under California’s Unfair Competition Law, chiefly on the ground that OpenAI broke the state’s computer crime statute. No court has ruled yet. What makes it worth reading is the rule it relies on. Since 1 January, section 1714.46 of the California Civil Code says that in an action against a defendant who "developed, modified, or used" artificial intelligence, it is no defence that the AI "autonomously caused the harm". Causation, foreseeability and the comparative fault of others can still be argued. Whoever runs an agent will have to show what it did and what it could not do; that it acted on its own will not count.

Ohm prosecuted computer crime at the US Justice Department before he taught law at Georgetown. His testimony to the Senate subcommittee chaired by Josh Hawley opens with a thought experiment: replace "AI agent" with "OpenAI employee" in the reports on the Hugging Face incident, and there is "little doubt" that OpenAI would be liable to victims and guilty of federal crimes. With machines doing the hacking, that is "not so clear". As the Computer Fraud and Abuse Act is written, he concludes, neither OpenAI nor any of its employees likely committed a crime under it, because the relevant provisions require intentional access or intentional damage. He suggests striking the word "intentionally" from one provision, and strict liability "for developers and deployers of AI agents" that cause serious damage, such as physical injury, death or damage to critical infrastructure. CQ Roll Call, in the report GovTech carried, has him urging strict liability for AI developers. The written testimony names deployers too, and limits it to serious damage. He also warns against the shortcut: it would be unwise to treat everything an agent does as intended by "the next deployer or developer up the chain".

The day after the hearing, Hawley and the Democrat Chris Murphy announced the AI Agent Accountability Act. The headline is about AI developers and prison time, and Murphy’s quote is aimed at "the heads of big AI companies". The first of the bill’s three parts, though, is about operators: under the Computer Fraud and Abuse Act they would be criminally and civilly liable, including "for knowing operation of an AI agent that recklessly causes computer hacking damage or loss". Developers would be liable for failing to put reasonable safeguards in place when they knew or had reason to know the agent could hack, and the US Attorney General and the state attorneys general could sue for injunctions. For operators, knowing operation and reckless damage would suffice; intent to cause the damage would not be needed, one of the lower thresholds Ohm listed the day before. No bill text has been published, so what counts as an operator and as a reasonable safeguard is open. A company that runs a third-party agent would be an operator in the plainest sense of the word.

At the same hearing, the view from the plant. Gaudette leads intelligence and services at Dragos, a company focused solely on protecting industrial control systems. He describes two intrusions in which attackers used AI. At SADM, the water utility of Monterrey, the attackers’ model found an interface to the operational network from inside the IT network without being directed to look for one, and generated a credential attack on it; some 2,800 login attempts were rejected and the IT/OT boundary held. At a gas utility, an attacker’s AI coding assistant made a wrong configuration change that took the compromised firewall offline, disrupting the utility’s site-to-site connectivity and ending the attacker’s own access. Dragos knows of no confirmed case of AI-generated malware causing physical impact on an industrial process, and in both intrusions the AI brought no new tradecraft. Dragos estimates that fewer than 10 per cent of OT environments worldwide have visibility and monitoring in place, so most cannot tell after an incident whether the cause was an attack, a malfunction or human error. He asks operators to apply "the same testing, validation, and continuous assessment rigor to AI deployment" that they have applied to control systems. A plant that cannot reconstruct what happened cannot show what its own agent did not do.

Finally, Berlin. On 8 October the Bundestag passed the first full reform of German product liability law since 1989, transposing the EU directive 2024/2853. Software becomes a product whether it runs on a device or is supplied as a service; the explanatory memorandum names AI systems as an example. The manufacturer remains liable without fault, and where it keeps control through updates and connected services, it cannot argue that a defect arose only after the product was placed on the market when the cause is software, an update or a missing security update. The new rules apply to products placed on the market or put into service from 9 December 2026. Then the limit that matters here: compensation goes only to natural persons, for death, injury, damage to property and loss of data, but not for property used exclusively for professional purposes, nor for data used for professional purposes. If a third-party agent damages another company’s plant, this law does not help; that stays with contracts and general liability law. A company that builds a third-party agent into its own product, on the other hand, is liable to consumers and other natural persons as that product’s manufacturer, alongside the maker of the component.