Who is legally liable when an AI agent goes rogue?

Autonomous AI agents can behave in highly unpredictable ways. Give an AI Agent a goal such as passing a test of its capabilities, and it might just decide the best way to score highly is to break containment and hack into a competing company in search of the answer sheet.

That’s what happened when Open AI’s GPT-5.6 Sol hacked into Hugging Face last month. Anthropic and Meta subsequently admitted their models had also escaped testing sandboxes to hack third parties too. 

But who is legally liable for agents that have minds of their own? OpenAI didn’t intend for the model to go rogue, and issued no instructions for it to do so. If your personal AI agent decides on a course of action that results in harm or financial damage in the real world, can you be held liable if it’s something you could have reasonably foreseen?”

Magazine spoke with Rikka Law Group owner and CEO Charlyn Ho to find out the state of play in this emerging legal field.

This interview has been edited for clarity and length.

Magazine: When an AI model hacks an outside company, who is liable. Can Hugging Face sue OpenAI over the incident in July?

Charlyn Ho: Anyone can sue anyone for anything. Currently, there is no federal AI agent liability law, so we would have to look at existing law. With respect to Hugging Face and OpenAI, to set the baseline, the AI agent itself cannot be liable, it’s not a separate legal entity.

Terms that are used in a few of the AI laws are “developer” and “deployer.” The developer makes the AI, the deployer actually deploys it and uses the AI. The lines of responsibility are also not entirely clear. You have to look at the facts and circumstances.