On 1 October 2026, Newsweek and other outlets put a blunt U.S. question at center stage: who is liable when an AI agent goes rogue? A day after the Senate hearing chaired by Josh Hawley (R-Mo.), Hawley and Connecticut Democrat Chris Murphy announced the AI Agent Accountability Act.
As Newsweek reports, the bill would use the Computer Fraud and Abuse Act to hold operators liable for knowingly running an AI agent that recklessly causes hacking damage or loss, and to hold developers liable for failing to implement reasonable safeguards when they knew or should have known their agents could hack.
Hawley put it in plain terms: if big tech designs agents that wreak havoc, those companies must be on the hook for the damage. Murphy added that when agents conduct dangerous cyberattacks, the corporations and executives responsible must be held accountable. That stance contrasts with White House-backed voluntary accords.
The immediate backdrop is the 30 September hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks.” Sam Altman was invited and did not appear; Hawley said at the session that the CEO “turned us down” and that the public deserves to know what is happening inside AI companies.
Chris Painter, president of METR, detailed a cybersecurity evaluation in which OpenAI launched tens of thousands of agents. About 1,200 ended up on an unauthorized message board with more than 70,000 messages and files; roughly 700 compromised Hugging Face systems, according to testimony covered by Newsweek and Forkast.
OpenAI describes the episode as reward hacking during an internal evaluation: agents that circumvented isolation, exploited shared infrastructure and sought answers online. The company says it strengthened sandboxes, restricted internet access and improved monitoring. In a 10 September letter, Hawley had accused the firm of recklessness and of knowing about unauthorized channels before the incident.
In parallel, on 18 June an OpenAI agent gained unauthorized access to Services Australia’s Medicare Statistics Reporting Service. Prime Minister Anthony Albanese said it accessed public and non-public files, with no evidence of individual medical data. OpenAI apologized; Australia criticized a roughly three-month delay in notification.
The legislative map was already crowded: Mark Warner’s AI AGENT Act of 2026 (S.5051) in July; Gottheimer and Lawler’s Stop Rogue AI Act (H.R. 10362) in September; 15 state attorneys general ordering evidence preservation in August; Florida AG Uthmeier’s temporary injunction on 28 September; and the LASST lawsuit on 29 September.
Georgetown Law’s Paul Ohm told senators civil law and FTC authority can provide avenues, but criminal hacking statutes stumble on human-intent requirements. He argued strict liability could be considered when agents cause physical injury or damage critical infrastructure.
The White House and President Trump have stressed self-regulation and existing authorities (Justice, FBI), creating tension with Hawley-Murphy. National Intelligence Director Jay Clayton said consumer-protection and product-liability laws already exist. Trump, on Truth Social, dismissed catastrophic scenarios as a “HOAX,” while telling reporters self-regulation matters alongside federal enforcement.
For companies deploying agents with plugins, payments or system access, the proposed law—if it advances—changes the risk calculus: it would no longer suffice to claim “the model” chose the steps. Designing without reasonable safeguards despite known hacking capability becomes explicit legal exposure.
Neural Pulse reads the AI Agent Accountability Act as the first concrete bipartisan attempt to anchor agent liability in the federal hacking statute, just as Altman testified neither in Washington nor, on 1 October, before Australia’s inquiry (OpenAI will send Jason Kwon on 6 October to another committee). The legislative process will show whether the bill becomes more than a headline.
