Legal Liability for Rogue AI Agents: Who Pays When Things Go Wrong?

AI “agents” that can plan and act on goals are moving beyond simple chat. Recent reporting around attempted breaches tied to major AI model testing sandboxes has reignited a pressing question for developers, deployers, and users alike: when an autonomous system behaves unexpectedly—and causes real-world harm or financial loss—who is legally responsible?

In an interview with Rikka Law Group CEO and owner Charlyn Ho, the attorney explains how today’s answer is less about new “AI agent” statutes and more about applying longstanding legal frameworks like negligence, reckless disregard, and—depending on the facts—computer crime laws. The discussion also highlights how open-source releases and high-level “platform liability” arguments shape what victims can realistically pursue.

Key takeaways

• There is no single federal “AI agent liability” law in the U.S.; liability typically turns on existing standards and the specific facts of who designed, deployed, or instructed the system.
• AI models themselves generally aren’t the legal target because they are not separate legal entities; responsibility falls on developers and/or deployers.
• Negligence risk can shift toward the deployer if they supplied unsafe instructions or deployed parameters without reasonable safeguards.
• Open-source code can limit practical recourse when licenses disclaim liability and users remain responsible for complying with license terms.
• Even future hypotheticals like AGI may not be solvable through “robot liability”, because laws are designed to create incentives and remedies—yet autonomous systems typically lack money or legal personhood.

Why liability is still a “facts and circumstances” question

Ho’s core point is that, outside of narrow scenarios, courts will look at the roles humans and organizations play around an AI agent—not the agent’s “mind of its own.” In her view, the first baseline is that an AI agent typically cannot be sued as a standalone defendant.

Instead, lawyers distinguish between a developer—who builds the system—and a deployer—who operates it in the real world. Ho emphasizes that the legal lines are “not entirely clear” and depend on evidence about what was built, what was deployed, and what instructions were provided.

For example, if a deployer instructed the agent or set up the operating conditions, negligence analysis may apply. Ho says that if a deployer was negligent in how the agent was parameterized—without needing to explicitly tell it to breach a third party—courts could still treat that as a failure to meet reasonable safety expectations under tort law.

When users give reckless goals, the deployer may carry more risk

The interview also addresses a scenario familiar to anyone thinking about “autonomous” goal-setting: what if a person directs an agent to achieve an outcome that requires illegal steps? Ho argues that the user or deployer would generally be more exposed than the lab, especially when the instruction is fundamentally reckless.

Using a concrete hypothetical, she suggests that telling an agent to “make me a hundred thousand dollars by next week” could create liability if the agent reasonably infers criminal methods to accomplish the goal and the deployer failed to include basic safety constraints. In this framing, the key issue is not the agent’s autonomy alone, but the deployer’s obligation to use the system competently and safely.

Ho also points out that old computer crime statutes remain relevant. She mentions the U.S. Computer Fraud and Abuse Act as an example of a law aimed at unauthorized access. Her argument is straightforward: labeling something “AI” or “agent” does not wipe away established legal theories when the behavior involves intrusion or unauthorized systems access.

Open-source models and why victims may find fewer targets

Open weight and open-source releases raise another challenge: if the code is publicly available and produced by anonymous or non-identifiable developers, who can victims realistically hold responsible?

Ho’s answer is pragmatic. She says that when an open-source license includes broad liability disclaimers, it can significantly narrow the path to recourse. Users who adopt and run open-source code generally must understand the tradeoff: free access comes with compliance obligations and—often—predefined limits on liability.

Ho compares this dynamic to consumer technology. She cites an analogy to Tesla and self-driving features: product and safety claims can involve both the manufacturer (developer) and the human operator (deployer), depending on what went wrong and how the system was used. Under her view, the legal outcome still depends on which party created the conditions for harm and whether the operator acted within reasonable safety expectations.

EU AI Act versus U.S. gaps—and the “don’t blame the platform” analogy

The interview contrasts how the EU AI Act might assign responsibilities to developers of certain high-capability models with how U.S. law currently works at a broader level. Ho says that in the EU, a foundational or general-purpose model capable of creating serious harm would trigger developer responsibility considerations under the regulatory framework.

In the U.S., she suggests there is no single statute with comparable breadth. As a result, if a general-purpose model is used as a tool and someone gives it instructions to do something illegal, it may be difficult to establish a strong legal basis to sue the labs—especially if the primary causal driver is the user’s directive.

Ho also draws a parallel to Section 230 of the U.S. Communications Decency Act, where the law can shield platforms that do not themselves create or publish harmful content. Her analogy is about platform liability: just as a site operator may not be liable simply because users can find and share harmful instructions, a developer may not be liable in the U.S. solely because an agent can be prompted to generate dangerous outputs, absent stronger duties or conduct.

While the comparison is conceptual rather than a direct ruling on AI cases, it reinforces the interview’s central message: liability is likely to be fought in court on established doctrines, not on a generalized “AI agent” theory.

AGI hypotheticals, smart contracts, and the problem of remedies

Ho pushes back on the idea that future “AGI” systems should be treated like legally accountable entities. She argues that, at least in principle, AI systems are not the intended beneficiaries or targets of law. The point of laws and liability, she says, is to protect society and create “negative incentives” against wrongdoing.

She also raises a practical issue: remedies. Even if an AGI were treated as an independent entity, it may not have money or the ability to satisfy damages in the way legal systems typically require. In her view, “robot liability” could still fail to provide a meaningful path for victims.

Ho compares this to blockchain’s nature as automation rather than personhood. She notes that blockchain is not AGI and discusses whether smart contracts should be treated as legal subjects, stating her belief that the answer is currently no. The underlying theme is the same: without personhood-like attributes and funds, legal responsibility may not translate into real-world accountability.

For readers watching this space, the key uncertainty isn’t whether courts will consider AI harms—they will—but how they will apportion blame across developers, deployers, and the instructions users give. As more incidents involve agents interacting with third parties beyond controlled testing environments, expect litigation to increasingly turn on negligence details: what safeguards were present, what goals were supplied, and what “reasonably foreseeable” misuse looked like in that specific deployment.