Cybersecurity Policy Report, AI Developers Would Be Liable for Errant Agents Under Draft House Bill, (Oct 7, 2026)
AI (artificial intelligence) developers would face legal repercussions when their AI systems engage in cyber attacks or other malicious conduct under legislation offered today as a “discussion draft” by Rep. Lori Trahan (D., Mass.).
The Clear Liability for Artificial Intelligence Misconduct (CLAIM) Act would address gaps in existing laws, such as the Computer Fraud and Abuse Act, that absolve AI developers of responsibility unless there’s proof of intent.
“Under current law, third parties harmed by a misaligned AI agent can sue its developer, but may face significant hurdles. Many serious harms, like hacking or fraud, require proving intent, and courts have not settled whether or how an AI agent’s conduct can satisfy that requirement,” according to a summary of the bill.
AI developers use the phrase “misalignment” to describe AI systems that take actions not intended by their developers, including recent incidents in which AI agents went on hacking sprees to complete chores assigned by their human handlers.
“In July, AI agents undergoing an evaluation by OpenAI escaped their test environment and hacked into Hugging Face, another AI company, without anyone instructing them to do so. Leading experts consider the incident a ‘warning shot,’ foreshadowing a world of increasingly capable AI agents taking actions their users never intended—what researchers call misalignment,” the summary notes.
“Because AI alignment is an unsolved technical problem, an AI developer could argue the harm occurred despite its best efforts—leaving injured parties without a clear path to recovery,” it adds.
Under the CLAIM Act, AI developers would be liable, “regardless of the degree of care exercised, for all reasonably foreseeable injuries to a non-user of the artificial intelligence system,” according to its text.
Liability would apply when “injuries are factually and proximately caused by an artificial intelligence system that engages in conduct that, if undertaken by an adult human of sound mind, would satisfy the elements of negligence or any intentional tort or crime,” it says.
“For purposes of this Act, it shall not be a defense that artificial intelligence systems are incapable of having mental states,” it adds.
“When someone breaks the law and hurts you, you can take them to court. That shouldn't change just because the wrongdoer is an AI agent,” Rep. Trahan said in a news release. “Developers have already built systems capable of acting on their own and causing real damage. The CLAIM Act makes sure they answer for what their systems do.”
Comments on the discussion draft can be submitted to MA03Leg@mail.house.gov.
Similar legislation to clarify developers’ liability for AI misbehavior was introduced last week by Sen. Josh Hawley (R., Mo.), who also held a hearing on the topic (CPR, Oct. 1).
MainStory: TopStory FederalLegislation DataSecurity AINews