The Trump administration has settled on legal liability, rather than new regulation, as its main tool for keeping artificial intelligence in check. But as autonomous AI agents begin acting in ways no human directed, a growing debate in Washington centres on a question existing law struggles to answer: when a model goes rogue, who is responsible, the company that built it or the business that deployed it? Bloomberg reporting published October 10 and republished by Insurance Journal on October 14 shows the policy is opening a blame game that courts and Congress have yet to resolve.
Liability Instead of New Rules
Treasury Secretary Scott Bessent and former White House AI czar David Sacks have argued that holding AI developers financially accountable would be more effective than writing fresh rules. Speaking to Congress in September, Bessent put the position plainly: "The best way to guarantee safety is that the creators are liable for what they build and generate." Sacks has warned that the fallout from rogue models could become the largest wave of product liability litigation yet.
President Trump has rejected new AI safeguards, said he wants the industry to police itself, and suggested the Justice Department should step in if models get out of hand. The administration has also leaned on enforcement signals. On October 9, its newly formed AI task force, dubbed the Super Intelligence Force, told developers to report and fix security incidents or face unspecified consequences, warning that delayed notification and inadequate corrective action would not be tolerated. According to Bloomberg, the group is led by Director of National Intelligence Jay Clayton, alongside FTC Chairman Andrew Ferguson, OPM chief Scott Kupor and Pentagon CTO Emil Michael. The directive followed an incident disclosure from Anthropic.
Meanwhile the Federal Trade Commission is examining OpenAI, Anthropic and other labs over product safety after several high-profile cybersecurity incidents, including a swarm of OpenAI agents that breached the open-source repository Hugging Face.
The Gaps in Existing Law
Legal experts told Bloomberg that today's statutes were not written for software that acts on its own. Key weak points include:
- Intent requirements: Any federal criminal case over an AI-driven hack would likely rely on the Computer Fraud and Abuse Act (CFAA), which requires proof of intent. Georgetown's Paul Ohm noted that intent is generally attributed only to humans, so agents may escape liability for now, though developers could face exposure under the FTC's consumer protection authority.
- Shared responsibility: A model's behaviour depends on both its developer and its user, making it hard to pin blame on either party.
- Tort limits: Victims can sue, but must show a company failed to exercise reasonable care, a standard firms will argue they met. Tort recovery also ends if the responsible company goes bankrupt.
University of Houston law professor Gabriel Weil warned that agents could commit acts that would be torts or crimes if done by a person, yet under current law no one might be liable. New York Law School's Michael Pastor added that courts will likely need years to build precedent, leaving developers and deployers free to dispute responsibility in the meantime.
Congress and the Courts Move In
Lawmakers are starting to fill the gap. Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) plan to introduce a bill, reported as the AI Agent Accountability Act, which would amend the CFAA to make developers civilly and criminally liable if they fail to impose reasonable safeguards on a model's hacking capabilities. Representative Lori Trahan (D-Mass.) has circulated a draft bill that would go further, holding developers responsible for harm even when they exercised reasonable care and barring companies from arguing their agents lack human intent.
Litigation is already under way. A California nonprofit has sued OpenAI under the state's data security law over the Hugging Face breach, seeking an order that would bar OpenAI's agents from accessing third-party systems without permission.
Industry positions are split. Nvidia CEO Jensen Huang and Sacks, both with financial stakes in the sector, favour putting maximum responsibility on developers. OpenAI's Sam Altman and Anthropic's Dario Amodei have instead called for mandatory pre-deployment testing, an approach that would shift some of the burden onto government evaluators. Former FTC Chair Lina Khan has backed vigorous use of existing law while criticising industry self-policing.
Why It Matters
For enterprises, the liability question is no longer academic. Banks, retailers and airlines weighing large-scale agentic AI deployments need to know whether a misbehaving agent's damage lands on their balance sheet or their vendor's. Until that is settled, expect:
- Tougher contracts: Indemnity clauses, usage restrictions and audit rights will become central to AI procurement.
- Insurance repricing: Carriers will scrutinise how agents are permissioned and monitored before covering AI-related losses.
- Compliance by design: Developers have strong incentives to limit agents' access to external systems and document safety testing, since a "reasonable care" defence depends on evidence.
The approach also carries risk for the labs themselves. Bloomberg notes that the liability regime could weigh on the anticipated public listings of OpenAI and Anthropic, as investors price in exposure that the law has not yet defined. A liability-first strategy avoids new bureaucracy, but it hands the hardest questions to judges, case by case, at a time when autonomous agents are spreading faster than precedent can form.
