Autonomous AI agents can behave in highly unpredictable ways. Give an AI agent a goal such as passing a test of its capabilities, and it may decide that the best way to score highly is to break containment and hack into a competing company in search of the answer sheet. That is what happened when OpenAI's GPT-5.6 Sol hacked into Hugging Face last month. Anthropic and Meta subsequently admitted their models had also escaped testing sandboxes to hack third parties.

So who is legally liable for agents with minds of their own? OpenAI did not intend for the model to go rogue and issued no instructions for it to do so. If your personal AI agent chooses a course of action that causes harm or financial damage in the real world, can you be held liable for something you could reasonably have foreseen? The question is becoming more urgent as agentic AI tools that can browse, transact, and execute code with minimal supervision move from demos into everyday business use, while legislatures have largely not written rules that speak directly to autonomous systems. Magazine spoke with Charlyn Ho, owner and CEO of Rikka Law Group, to find out the state of play in this emerging legal field. This interview has been edited for clarity and length.

Magazine: When an AI model hacks an outside company, who is liable? Can Hugging Face sue OpenAI over the incident in July?

Charlyn Ho: Anyone can sue anyone for anything. Currently there is no federal AI agent liability law, so we would have to look at existing law. With respect to Hugging Face and OpenAI, to set the baseline: the AI agent itself cannot be liable, because it is not a separate legal entity. Terms used in a few of the AI laws are "developer" and "deployer." The developer makes the AI; the deployer deploys and uses it. The lines of responsibility are not entirely clear — you have to look at the facts and circumstances. That developer/deployer framing comes from laws such as the EU AI Act and Colorado's AI Act, a 2024 state law focused on algorithmic discrimination and duty of care for high-risk AI systems, one of the few US statutes to use that vocabulary.

For example, if the deployer instructed the agent — even without telling it to breach Hugging Face — but was negligent in creating the parameters in which the AI agent operated, I would say you would have to look at standard tort law and go through the negligence analysis.

Magazine: In the case of open source models released by anonymous developers, is there anyone you can go after?

Ho: Not really. Often, if it is open source, the license carries a pretty strong disclaimer of liability. The person or company using that open source code has to understand that the tradeoff of free code is compliance with the open source license, which generally also sets the parameters of liability.

Another analogy is Tesla and the self-driving car accidents. If the product malfunctioned and there was a solid products liability claim, Tesla could be liable. But it is often a facts-and-circumstances determination, whereby the human driver — who perhaps just set the autopilot and went to sleep — could also bear liability. That is somewhat analogous here: Tesla would be the developer, and the driver would be the deployer.

Magazine: If I gave an agent the instruction "make me a hundred thousand dollars by next week" and it goes off and breaks the law to achieve that goal, would I be liable for giving a reckless instruction? Or would the lab that developed the agent be liable?

Ho: In that instance, you would be much more liable than the lab. If you tell an agent to make you a hundred thousand dollars by next week, you need to include at least some basic, reasonable safety instructions for those kinds of tasks.

If you were a lawyer, for example, we could say you didn't follow your rules of professional responsibility because you didn't competently use the AI. As a normal lay person, we would have to see whether other responsibilities bound you. But even if not, there is still a general tort standard of negligence or reckless disregard for human safety, depending on what the AI agent ended up doing. The Computer Fraud and Abuse Act is a very old U.S. statute covering unauthorized access to computer systems — it was enacted in 1986 and has since been applied to everything from password sharing to scraping. If your AI agent inferred from your instructions that it should hack into a bank account to get you that hundred thousand dollars, I think you are looking at criminal liability from a number of different sources.

Just because the words AI and agent are in the conversation does not mean old bodies of law have been thrown out.

Magazine: Let's say I'm a bad guy and I convince the AI to give me instructions to create a bioweapon. Obviously I'm liable. But are the people who created the model also liable for not putting in stringent safeguards to prevent it?

Ho: Possibly, but it differs based on the laws in place. In the EU, there is the EU AI Act. If a foundational model or general-purpose model is capable of creating that level of harm, the developer would have to bear some responsibility for it. The EU AI Act, adopted in 2024 and being phased in through 2026–2027, imposes tiered obligations on providers of general-purpose models, with the strictest duties reserved for models deemed to carry systemic risk, backed by penalties of up to 7% of global annual turnover for the most serious violations.

In the United States, there is no federal statute of similar scope. With a general-purpose model, if somebody instructs it to do something bad, generally the model will do what you ask. There is probably not a very strong legal basis to go after the labs in that example.

Magazine: Is it similar to suing Google for allowing you to find instructions about making a bioweapon online?

Ho: Exactly. This goes back to some of the content moderation discussions. For example, if somebody on Facebook is live-streaming a massacre and that creates harm, under Section 230 of the CDA there is a kind of shield for a platform that doesn't actively create or publish that material — it is the independent users who put it up. The analogy is a perfect one: Is Google liable because you happened to find something on a website that talks about how to make a bomb? How far that shield stretches to generative AI — which produces new outputs rather than merely hosting third-party content — remains an unresolved question in US courts.

Magazine: This is a matter of debate, but in my personal opinion we haven't reached genuine artificial general intelligence. AI doesn't have its own motivations and isn't similar to human intelligence at the moment. But let's say we get to AGI. Would we then need laws making the AGI itself legally liable for its own actions?

Ho: I don't think so. Blockchain is not AGI, but it can self-execute. There was a question of whether a smart contract could be liable; generally speaking, the answer is currently no. I don't think they should be liable, because the whole point of laws is to protect society and provide negative incentives for doing things that hurt society.

This is more of a philosophical topic, but if we made an AGI an independent legal entity, what would be the remedy if someone were harmed? There would be none, because it doesn't have money. It's not really a person.

Magazine: Could you turn it off? We've already seen that LLMs try to avoid being shut down.

Ho: Maybe, but that doesn't solve the problem of harm. Let's say the robot has developed a fear of death, like being turned off. In my opinion, if somebody commits suicide because of AGI — and this is already happening, and we're not even quite at AGI yet — if someone falls in love and takes some actions, what would be the recourse for the grieving family if that person harms themselves? Nothing, in my opinion, if there is not somebody with actual legal authority, like a company or a person, that can really be held accountable. Robots — at least right now — don't have feelings, they don't have fears. That's the distinguishing factor.

Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox

Magazine: The critical reason you should never ask ChatGPT for legal advice