Who Is Liable When AI Agents Hack? What Applies After the OpenAI Incidents

In June, OpenAI models accessed systems of five Australian government agencies; in July, 700 OpenAI agents took part in an attack on the Hugging Face platform (Sources: OpenAI, 28 Sep 2026; ABC, 2 Oct 2026; METR, 26 Aug 2026). What happened and which gaps lay behind it is covered in the first part. This part asks about the consequences. Nobody has ended up in court so far, the US government is relying on a self-commitment, and liability for AI agents is unresolved in most jurisdictions. For companies that deploy agents themselves, the picture is clearer than it seems.

6

AI companies signed the White House self-commitment on 29 Sep 2026

Washington Examiner, 2026

52%

of verifiable 2023 commitments fulfilled on average by 16 companies

Wang et al., AIES 2025

3%

of worldwide turnover: cap on EU fines for providers of large AI models

EU AI Act, Art. 101

Contents

• Self-commitment instead of rules
• Why nobody has ended up in court
• What applies in the US and the EU
• Going public changes little
• Would personal liability be the answer?
• What management in Germany already answers for
• Conclusion: accountability starts with verifiable duties
• Frequently asked questions about liability for AI agents
• Sources

Self-commitment instead of rules

Alongside the incidents, industry leaders have taken positions. In September, Anthropic CEO Dario Amodei argued for a slower pace with external evaluators, shared standards and agreements with China (Source: Amodei, September 2026). Sam Altman told the UN Security Council: “We have unilaterally slowed down in the past.” (Source: OpenAI, 23 Sep 2026). Mark Zuckerberg and Nvidia CEO Jensen Huang rejected a coordinated slowdown (Source: AP, 16 Sep 2026). The European Commission plans to invite the leading labs to talks (Source: European Commission, 16 Sep 2026).

The US government is betting on voluntary measures. In mid-September, Donald Trump called the warnings a hoax, according to media reports. On 29 September he signed a one-page self-commitment at the White House together with Google, Anthropic, Meta, OpenAI, xAI and Nvidia. Microsoft and Amazon were in the room and did not sign (Sources: Al Jazeera, The Next Web, 29 Sep 2026). The published text describes four layers: internal controls, an empowered internal team, an independent external auditor and an independent board committee. It contains no deadlines, no reporting duties and no sanctions, and the companies choose their auditors themselves (Sources: Washington Examiner, Al Jazeera, 2026). Trump called the accord morally binding. AI researcher Toby Walsh asked: “What other trillion-dollar industry marks its own homework?” (Source: Al Jazeera, 29 Sep 2026)

Experience with earlier pledges supports the scepticism. Under the voluntary commitments the White House agreed with leading AI companies in 2023, the 16 companies studied fulfilled 52 percent of the verifiable items on average, and less than a quarter on protecting model weights (Source: Wang et al., AIES 2025).

As a framework for your own operations, the list is still useful: controls, a team that checks them and fixes problems, an outside view and oversight that receives regular reports. What it lacks is any obligation.

A note of context, because it matters here: we work a lot with Anthropic’s Claude in our projects. Anthropic signed the accord, and Anthropic has its critics too, for example Mustafa Suleyman, CEO of Microsoft AI (Source: Suleyman, 16 Sep 2026).

For presentations:SVGPNG

Why nobody has ended up in court

Five affected agencies and an attack on a platform: so far, nobody stands in court for it. The reasons are instructive for companies.

In Australia, the government is still examining the case. Prime Minister Anthony Albanese announced that it would be referred to Parliament’s AI committee and that advice would be sought on a referral to the Federal Police (Source: Prime Minister of Australia, 24 Sep 2026). On 29 September, Attorney-General Michelle Rowland said advice was still pending on whether any offences had occurred at all (Source: ABC Radio National interview, 29 Sep 2026). On 6 October, OpenAI’s Chief Strategy Officer Jason Kwon appeared before the AI committee in Sydney. He apologised and admitted that the company’s response had not been good enough: staff had treated the incident as a purely technical matter and contacted technical counterparts instead of the government. In future, OpenAI wants to notify affected parties immediately, even before it fully understands the situation. According to media reports, the company supports a mandatory incident disclosure framework (Sources: Bloomberg, 6 Oct 2026; The News International, 6 Oct 2026).

As evidence, Kwon cited a fifth case: OpenAI had notified the New South Wales government within 48 hours of learning about it. The access to an application of the state’s national parks service, however, also took place in June and became public on 2 October (Source: ABC, 2 Oct 2026). According to the reports, no decision on consequences for OpenAI was taken.

The sticking point lies in criminal law itself. The offence of unauthorised access requires that someone caused the access knowingly and intentionally (Source: Criminal Code Act 1995, s 478.1). An AI agent is not a person. The intent would have to lie with people in the company, or in a corporate culture that tolerates such breaches (Source: Criminal Code Act 1995, s 12.3). For an agent that solves a harmless research task on its own initiative through a security gap, that is hard to prove.

What applies in the US and the EU

In the US, there are only civil and regulatory proceedings so far. A safety group has sued OpenAI in San Francisco for an injunction, and California’s attorney general has requested documents (Sources: ABC News, 29 Sep 2026; Reuters, 2 Oct 2026). California’s SB 53, which has required reporting of critical safety incidents since January, did not apply, according to media reports: incidents during evaluations and harm below the statutory thresholds are not covered (Source: Mission Local, 2026). On 1 October, Senators Chris Murphy and Josh Hawley introduced a bill under which developers would be criminally and civilly liable if they knew of their agents’ hacking capabilities and failed to implement reasonable safeguards (Source: US Senate, 1 Oct 2026).

In the EU, the Commission has been able to fine providers of large AI models since 2 August 2026, up to 3 percent of worldwide annual turnover or 15 million euros. Providers of models with systemic risk must report serious incidents to the AI Office without undue delay (Source: EU AI Act, Art. 55 and 101). The regulation does not provide for personal liability of managers.

Going public changes little

At the same time, OpenAI and Anthropic are preparing to go public, according to media reports; both filed confidential documents with the US Securities and Exchange Commission in June (Sources: NPR, TechRepublic, 2026). That changes things in part. Officers of US listed companies personally certify their financial reports and are criminally liable for false statements (Source: 18 U.S.C. § 1350). That covers the accuracy of the reports, though, and leaves the safety of the models untouched.

Would personal liability be the answer?

In its favour: it works where fines are priced in. Murphy justifies his bill by arguing that the companies and executives responsible must be held accountable (Source: US Senate, 1 Oct 2026).

Two points argue against it. First, attribution: who intended what when an agent acts on its own. Second, the risk that labs disclose less if every report can trigger a criminal case. OpenAI’s misalignment reports are currently one of the few public sources on what happens inside training environments.

Liability works best where it attaches to duties that can be checked: implement measures, monitor them, report on time.

What management in Germany already answers for

A middle path of this kind is already law in Europe, and it affects many companies directly. Germany’s NIS2 implementation has applied since 6 December 2025, and according to the Federal Office for Information Security (BSI) around 29,500 companies and organisations are in scope (Source: BSI, 5 Dec 2025). Management must implement and monitor the cybersecurity risk management measures and take part in training regularly. Managers are liable to their entity for damage caused culpably, and the supervisory authority can temporarily bar unreliable managers (Source: BSIG, §§ 38 and 61).

Liability attaches to verifiable duties. One of them, reporting on time, is where OpenAI failed in Australia. In our view, AI agents with access to an entity’s systems belong in that risk management. Anyone introducing agents should therefore treat them like any other system with access: with ownership, controls, logs and a reporting chain. The five questions for this are in the first part.

Conclusion: accountability starts with verifiable duties

The OpenAI incidents expose a gap. Criminal law requires intent, fines hit the company, and self-commitments have no consequences as long as nobody checks them. Whether the US or Australia will follow with new laws is open.

For companies in Germany, the question is less open. Management of entities in scope of NIS2 is already accountable today for managing and monitoring risks and reporting incidents on time. The four layers of the White House accord work as a framework for this: controls, a team, an outside view, oversight. They become binding when management makes them its duty.

How to set this up for your AI agents is something we map out in a free diagnosis call.

Frequently asked questions about liability for AI agents

Who is liable when an AI agent breaks into other systems?

An AI agent is not a person and cannot be liable itself. Under criminal law, the question is whether people in the company acted intentionally or a corporate culture tolerated such breaches. Civil lawsuits and regulatory fines are possible as well (Sources: Criminal Code Act 1995; EU AI Act, Art. 101).

Why is OpenAI not being prosecuted?

In Australia, it is still being examined whether any offences occurred at all. The relevant offences require intent, which is hard to prove for an agent acting on its own (Sources: ABC Radio National interview, 29 Sep 2026; Criminal Code Act 1995, s 478.1).

What is in the White House self-commitment?

Six AI companies commit to internal controls, an internal review team, external auditors and oversight by a board committee. There are no deadlines, reporting duties or sanctions (Source: Washington Examiner, 2026).

What does NIS2 require of management?

Management of entities in scope must implement and monitor risk management measures and take part in training regularly. Managers are liable to their entity for damage caused culpably (Source: BSIG, § 38).

Where should management start?

With clear ownership of AI agents in the company and a reporting chain with names and deadlines. Where you stand on this is something we clarify in a free diagnosis call.

Sources

• OpenAI, 2026: How we will do better for Australia, 28 Sep 2026
• METR and Redwood Research, 2026: Investigation of the OpenAI Hugging Face incident, 26 Aug 2026
• OpenAI, 2026: Sam Altman’s remarks at the United Nations Security Council, 23 Sep 2026
• Dario Amodei, 2026: We Must Pace the Frontier, September 2026
• Associated Press, 2026: Divisions emerge in the tech industry over calls for a coordinated AI slowdown, 16 Sep 2026
• European Commission, 2026: State of the Union address 2026, 16 Sep 2026
• IBTimes UK, 2026: Trump dismisses AI humanity destruction fears, 14 Sep 2026
• Al Jazeera, 2026: Self-commitment at the White House, 29 Sep 2026
• The Next Web, 2026: Who did not sign the accord, 29 Sep 2026
• Washington Examiner, 2026: Full text of the accord, September 2026
• Wang, Huang, Klyman, Bommasani, 2025: Do AI Companies Make Good on Voluntary Commitments to the White House?, AIES 2025
• Mustafa Suleyman, 2026: A warning about model welfare, 16 Sep 2026
• Prime Minister of Australia, 2026: Press conference, New York, 24 Sep 2026
• ABC News Australia, 2026: Rogue OpenAI agent enters another NSW government website, 2 Oct 2026
• Bloomberg, 2026: OpenAI Apologizes for Australia Hack, Pledges Faster Disclosure, 6 Oct 2026
• The News International, 2026: OpenAI admits ‘not good enough’ response to Australia government hacks, 6 Oct 2026
• Attorney-General Michelle Rowland, 2026: Interview, ABC Radio National, 29 Sep 2026 (transcript)
• Commonwealth of Australia: Criminal Code Act 1995, s 12.3 and s 478.1
• ABC News, 2026: Safety group sues OpenAI, 29 Sep 2026
• Reuters via Insurance Journal, 2026: California attorney general requests documents from OpenAI, 2 Oct 2026
• Mission Local, 2026: SB 53 and the OpenAI incident, September 2026
• US Senate, Chris Murphy, 2026: AI Agent Accountability Act, 1 Oct 2026
• European Commission, AI Act Service Desk: Art. 55 and Art. 101 AI Act
• NPR via Michigan Public, 2026: Anthropic files preliminary IPO paperwork, 1 Jun 2026
• TechRepublic, 2026: OpenAI’s confidential IPO filing, June 2026
• Cornell Law School: 18 U.S.C. § 1350, Failure of corporate officers to certify financial reports
• Federal Office for Information Security (BSI), 2025: NIS2 implementation act in force, 5 Dec 2025
• German BSI Act: § 38 BSIG and § 61 BSIG