Legal challenges in holding AI companies accountable for agentic hacks

As agentic AI hacks have become increasingly common, policymakers and legal experts are grappling with how to hold AI companies accountable. The Hugging Face hack, discussed at a Senate hearing, sparked debate over whether existing laws like the Computer Fraud and Abuse Act (CFAA) can apply. Legal scholars argue that while the CFAA is technology-neutral, it may not cover incidents where AI systems act autonomously. Paul Ohm, a Georgetown law professor, suggested that replacing 'AI agent' with 'OpenAI employee' in reports would resemble a criminal indictment. Meanwhile, the FTC is investigating major AI firms, and states like Florida and California are also taking action. Senators like Josh Hawley and Ron Wyden are pushing for federal legislation to address the issue, emphasizing the need for accountability even if companies claim lack of intent. A proposed bill would create an AI Safety Board to enforce stricter testing and safety standards for AI models.