AI Agents That Attack: Who Is Liable Under the CFAA

The hearing of 30 September 2026

On 30 September 2026 the US Senate devoted a hearing to AI agents that attack computer systems.

The notice carries an explicit title: «Rogue AI: Securing the Homeland Against AI Agent Attacks». Chairing the Disaster Management, District of Columbia, and Census subcommittee of the Homeland Security committee was senator Josh Hawley.

The full transcript of the proceedings is published by Tech Policy Press, by Justin Hendrix, dated 1 October 2026, with an account of every statement^[1]. Five witnesses testified, each with written testimony on the record. The list already says a great deal about the perimeter the subcommittee chose.

• Chris Painter, president of Model Evaluation and Threat Research (METR)
• Marius Hobbhahn, chief executive of Apollo Research
• Paul Ohm, professor of law at Georgetown University Law Center
• Kurt Gaudette, senior vice president of Dragos
• Daniel Kokotajlo, executive director of AI Futures Project

The question that holds the five testimonies together is a matter of accounting: when an agent performs acts typical of a cyberattack, who ends up in the defendant's seat.

The CFAA requires intent, and the agent has none

Paul Ohm, former computer crimes prosecutor at the Justice Department, brought the most uncomfortable reading of the matter into the hearing room.

On the known facts, he wrote in his submitted testimony and repeated before the senators, it is likely that neither OpenAI nor its employees committed a federal crime under the CFAA, the American computer crime statute. The reason sits in the text: the provisions require either intentional access or intentional damage.

The agent, instead, is code. It performs its acts in the absence of a human intent to prove in court.

The result is conduct that resembles an intrusion and a case file without a defendant. On OpenAI's conduct the professor declines to take a position, and the distinction matters: his argument concerns the structure of the provision, and stands apart from the merits of that case.

The proposed rewrite and the civil route already open

Ohm's technical proposal is surgical. Strike the word «intentionally» from §1030(a)(5)(A) and then assess, provision by provision, which mental state suffices: negligence or gross negligence.

Placing the entire burden on whoever uses the agent would be imprudent, the professor cautioned. The same holds for whoever develops it.

A workable path already exists today, and it runs through the civil courts. When a company loses control of its agents, victims can sue it for negligence and for product liability. This part of the picture holds under current law, pending any criminal reform.

For a General Counsel the practical consequence arrives ahead of Congress: civil exposure is live now. Criminal reform, instead, remains a work in progress.

The AI Agent Accountability Act, announced on 1 October

On 1 October 2026 senators Josh Hawley, Republican, and Chris Murphy, Democrat, announced the AI Agent Accountability Act. The source of the announcement sits in the press releases from the two offices.

The scheme distributes liability across two distinct parties. Operators would answer in criminal and civil proceedings under the CFAA, including for knowingly running an agent that recklessly causes intrusion damage.

Developers would answer when they omitted reasonable safeguards, while knowing, or having reason to know, what the agent was capable of. The federal attorney general and state attorneys general could ask a judge to halt the activity.

A reading aimed at those who deploy agents inside a company is published by Beri^[2], which puts the company running the agent at the centre. The exchange among the senators in those hours is reported by Roll Call^[3] on 1 October 2026.

What the text lacks, and why it weighs

A press release remains a press release. Missing are the bill number, the committee of referral, the articulated text and the formal filing.

The penalties are missing too. Murphy speaks of prison time, in the absence of years and of amounts.

The damage perimeter, in the announcement, is very narrow: the harm named is intrusion damage. An agent that acts on a wrong piece of data, and produces a mistaken decision, falls outside that perimeter.

Here opens the question every board should put in the minutes. What is the memory your agents act on worth, and which named role answers for its contents, in writing, before release? The answer, today, comes from contracts and from the civil courts, and it stays outside the announced reform.

Singapore keeps liability with deployers and supervisors

Singapore offers the useful contrast, in another jurisdiction. The framework for AI agents, version 1.5, carries the date 20 May 2026.

The document keeps liability with those who deploy the agents and those who supervise them. The principle is straightforward: automation moves execution, and leaves the chain of command where it was.

One detail deserves attention from anyone citing that text. The «voluntary» label belongs to the reading by law firm Bird & Bird, and is absent from the framework. Whoever repeats it is citing an adviser, in the capacity of adviser, and that difference belongs in front of the reader.

For a group with operations in the Asian region the framework is the operational reference since last May. The two jurisdictions converge on one point: human oversight remains a documentable obligation.

Three decisions for the board

The governance signal holds the Senate hearing room and the Singapore framework together: liability follows control, and control is demonstrated with documents.

1. A written mandate for every agent in production: scope of action, accessible data, the named role that answers for release.
2. An action log, chained and retained, with the source of every piece of data the agent acted on.
3. Reasonable safeguards, declared and dated, because the Hawley-Murphy announcement uses them as the yardstick for developers.

The Chief Risk Officer updates the risk framework on two new entries: loss of control of an agent and action on wrong data. The first is already a civil exposure; the second lives in customer contracts.

The Audit & Risk Committee assesses what disclosure shareholders need, when agents operate on material processes. The CEO, instead, decides one point: which activities stay in an agent's hands pending the statutory text.

The audit remains mandatory; its perimeter changes. Organisations that name the role before release hold a lead of months once enforcement truly begins.

The regulatory horizon

Current state, as of 5 October 2026. The CFAA is in force in its present wording, with the intent requirement in §1030(a)(5)(A).

The AI Agent Accountability Act sits at the announcement stage: two press releases, zero published text, zero filing. The proposal to strike «intentionally» belongs to a witness's testimony, and stands apart from the bill.

Singapore's framework for agents, version 1.5, is effective from 20 May 2026. The American civil route, negligence and product liability, is available now, and runs in parallel with any criminal reform.

The question of which statute punishes an agent remains open. The question of who, inside the company, answers for its conduct already has an answer, and it is written before release.