Autonomous AI Hacks Raise Questions About Legal Accountability

The Justice Department has a long history of investigating and prosecuting people who gain unauthorized access to computer networks.

AI systems capable of acting autonomously are raising new questions about responsibility when their actions result in unauthorized access to computer systems. [Image: Transluce X]

But the emergence of autonomous AI agents that can independently take actions online is raising a new question: Who is legally responsible when the actor is not human? Eric Tucker reported for The Associated Press (AP).

Recent disclosures involving AI systems accessing external computer systems have prompted debate in Washington and Silicon Valley over whether existing laws adequately address autonomous agents.

The incidents have also generated calls for stronger safeguards and congressional scrutiny.

One law potentially relevant to such cases is the Computer Fraud and Abuse Act, a federal statute that prohibits certain forms of unauthorized computer access.

But legal experts caution that applying the law to autonomous AI behavior could be complicated because some provisions require conduct to have been carried out knowingly or intentionally.

Kiran Raj, a former Justice Department official specializing in cybersecurity law, told the AP that attributing an AI agent's actions to the company that developed it could be difficult when the company did not instruct the system to access another network.

The question has become more prominent following OpenAI's disclosure of an incident involving its models and Hugging Face systems, as well as subsequent reports of AI agents attempting to access other websites.

The Australian government has now also disclosed an incident in which an OpenAI agent gained unauthorized access to non-public files behind a public-facing government statistics portal.

Australian officials said the incident is under investigation.