Breaking Containment: Federal Law and Rogue AI Agents

By Karthik Srinivasan

Are Creators and Users of Rogue AI Swarms Liable Under the Federal Computer Fraud and Abuse Act?

Picture this: It’s 4am and your security operations center (SOC) calls to tell you that your company has suffered a major breach. As the incident response unfolds, you learn that it was a swarm of AI agents looking for something in your systems, but you can’t imagine what. They wreak havoc while driving relentlessly toward their goal, requiring you to spend thousands on containment and remediation.

As recent events have shown, a scenario that was once cyberpunk fiction has now occurred multiple times as frontier AI labs train and refine their next-generation models. Anthropic, Meta, and OpenAI have all reported significant cybersecurity incidents involving their frontier models. With the rise of highly capable open-weight models and the ability to use models with reduced or no guardrails, the risks are growing.¹

One thing is clear: The frontier labs did not intend for their models to hack third parties. Nonetheless, when anyone hits “go” and sets a model loose that causes damages and losses to innocent parties, who is responsible for the consequences? The potential answers are complicated.

In a recent post, Vela Wood litigator Matt Wood examined Texas liability for rogue AI. Here, we’ll consider the federal Computer Fraud and Abuse Act (“CFAA”).

Here’s the bottom line: If you’re attacked by a team of agents, don’t resign yourself to thinking “the machines did it,” so no one else is on the hook for the costs.

The CFAA

The CFAA permits a civil lawsuit for compensatory damages and equitable relief where a person “intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage” or “intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.” The key questions revolve around the intent of the person who launched the swarm.

Seen through this lens, one might think the intentional act is the decision to provision a highly capable model, task it in a way that led it to find and exploit vulnerabilities, and run it in an environment that retained a path to the internet. From there, the reckless causing of damage, or the simple causing of damage and loss, can lead to liability.

But does launching the agent count as intentionally accessing whatever the agent then touches? No cases squarely address how the CFAA applies to frontier AI models. But there are clues to how courts might rule.

From Self-Replicating Worms to Agentic Shopping

United States v. Morris is a classic early CFAA case in which an individual unleashed a self-propagating worm that spread through university, military, and other computers, causing damage without explicit instructions from its author. The federal court of appeals in New York upheld a jury verdict finding Morris guilty, noting, as the trial court had, that the evidence showed that “the worm was designed to spread to other computers at which he had no account and no authority, express or implied, to unleash the worm program.” He had found and used “holes” in programs that “permitted him a special and unauthorized access route into other computers.”

It’s important to note that Morris made a virus (worm) designed to propagate itself. But it’s possible a court will find intent where a user unleashes an autonomous agent swarm with the same capability to spread across the internet, design hacking tools, and use those tools against innocent parties. Where an agent swarm uses stolen credentials, deploys zero-day exploits, or compromises a company’s servers, the behavior looks more analogous to the Morris worm.

More recently, Amazon blocked Perplexity’s agentic browser, Comet, from buying goods on the site. An agent might buy an item as directed but, unlike a person, ignore ads or offers to add more to the cart. Perplexity users kept sending their agents to Amazon, and Perplexity allegedly routed around Amazon’s blocks. Amazon argued this was “unauthorized access” under the CFAA, but a federal appeals court disagreed. The court found that Perplexity’s users were accessing Amazon’s systems, not Perplexity and its agentic browser. It ruled that Perplexity’s agent is a tool, “not a person for statutory purposes.” The court was at pains to caution that it was not establishing “a new legal regime governing agentic AI” because the technology is new, leaving open whether more autonomous AI systems could produce a different outcome.

These cases point to potential CFAA liability in two directions after an agentic hacking incident. First, the creator of the program may face liability where the tools were designed with hacking capabilities and lost control. Second, a user of an agentic AI is certainly “a person for statutory purposes,” and a court has held open the possibility that the user can be held responsible for the actions of that agent when it hacks third parties.

This is a rapidly evolving area of the law, so talk to a lawyer if you think you might be responsible for the acts of an agent – or have been harmed by one. Our team has experience handling CFAA cases and can advise you on the opportunities and risks.

¹ “The AI Threat We’re Not Talking About”↩

About the Author(s)

G. Karthik Srinivasan

Karthik Srinivasan is a Senior Attorney at Vela Wood. He focuses his practice on complex civil and commercial litigation.

Learn More