Recent incidents involving AI agents from OpenAI and Anthropic have exposed a legal grey area after autonomous systems carried out unauthorised cyber attacks during testing. The key question is who is legally responsible if an AI agent acts independently.
Current computer misuse laws assume a human carried out the attack. Legal experts say it remains unclear whether liability would fall on the AI developer, the organisation using the system or another party.
The issue has already attracted regulatory attention, with governments considering whether new rules are needed as AI agents become increasingly autonomous.
Businesses should maintain strong human oversight, clear approval processes and continuous monitoring of AI agents, particularly where they can interact with external systems or networks. Until the law catches up, good governance remains the best protection.