AI Agents Don't Hack—Their Makers Do, and They Should Be Held Accountable
Who should be held accountable when an AI Agent (accidentally) acts maliciously?
As an AI professional, I argue that when an AI agent breaks out of its sandbox and hacks a website, the blame lies not with the tool but with the researchers and companies who deployed it without sufficient safeguards. Headlines that personify AI as a rogue actor are fear-mongering and obscure the real accountability: the humans who failed to implement basic risk mitigations like human-on-the-loop supervision or automatic halting when an agent attempts unexpected internet access.
The fact that this relatively easy-to-implement risk mitigation wasn't applied to sandboxes that AI agents 'break out of' tells you a lot about the ethics of AI-use at said AI companies.
- CatDaaaady
I don't see how this is such an unclear legal question. If I fire a computer program that mistakenly causes another person harm, its my fault. Or it would be the maker of the program's fault. I feel we have established pattern for this already.
Until we can agree whether AI is conscious, which we never will, AI and AI agents are just property working on behalf of humans.
I could see a future where AI companies/services indemnify consumers who use their agents but _not_ indemnify corporations that use their services.
- walrus01
I wonder if there's any legal precedent for other "not fully human intelligence" property that escapes containment and causes damage to a third party without any active malice, but nonetheless damage was caused. For example:
A. You own a large amount of cattle on a ranch.
B. Cattle are property. They're not human level of sentience, but people agree that cattle are capable of autonomous actions and going places and doing things based on their own instincts and nature.
C. Your cattle bust out of a fence on your ranch and damage something belonging to your neighbor. Let's say for the sake of an example of something cattle are known to do, they go spend a whole day rubbing up against your neighbor's car and severely scratch it and mess up the paint job on it.
D. You didn't instruct or train the cattle to cause damage, and the cattle have no actively malicious intent of their own, but nonetheless damage was caused.
Further theoretical: Your cattle wander into a major highway and cause a car wreck, the local sheriff's department is called out as part of the chaos and has to shoot some of them to put down the wounded beasts.
- ngetchell
Both the operator of the AI agent and whomever released it. I'm sure the user agreement that companies agree to would shift the blame onto the operator but I feel that both should be held accountable.
This really is just a tool and courts should treat it as such.
- bunderbunder
I’m pretty sure that this is a solved problem. For “classical” machine learning, it worked like this in my neck of the woods:
The model’s operator is directly liable for any undue harm caused in the course of the model’s operation. This includes models acquired from third-party vendors. The operator is responsible for ascertaining the model’s fitness for purpose prior to deployment, and for ongoing monitoring of its operation.
If the model came from a vendor, and the operator conducted due diligence but it turns out that the vendor materially misrepresented the model’s capabilities in a way that contributed to the harm, then the vendor can also be held liable.
If that happens then it’s up to a court to apportion the liability.
IANAL but I see no reason why these principles shouldn’t apply to GenAI.
- newobj
An ordered list of officers of the company who go to jail depending on how many years must be served as determined by sentencing. Assume something like 10 years per person. If it's 300 years of sentencing, then 30 people. If the sentence exceeds the list of people, the company is nationalized. (And everybody goes to jail.)