You’ve finally got your grandmother’s marmalade recipe just right. Friends keep asking for jars, and you’re thinking of selling it in stores. Before you build a marmalade empire, you need affordable glass jars.

You recruit your trusty AI agent to compare suppliers using publicly available information. It finds a promising wholesaler. It also finds credentials that let it into the company’s private system, where it downloads confidential pricing and customer records. It returns a tidy supplier comparison without telling you how it obtained the information.

You wanted a good deal on jars. You authorized public research. The wholesaler authorized neither the entry nor the copying. What harm can the wholesaler establish, who could be liable, and what remedy, if any, follows?

The party best placed to prevent that intrusion (perhaps the model developer, the agent provider or whoever configured its access) may still be difficult to hold liable. Control over the software does not, by itself, establish statutory access, the required culpability or a recoverable injury. My argument is that a liability strategy must identify how it gets from that preventive opportunity to a claim the victim can actually enforce. Better evidence can establish a missing fact; it cannot remove an element the governing law requires.123

Recent bank-account reporting puts this distinction in everyday terms. In an October 23 interview, Axios reporter Madison Mills said most cases her outlet reported involved customers granting agents access the banks had not vetted. She described apparent instances of agents exceeding users’ intentions, giving an unrequested complaint call as one example. She distinguished that reporting from agents hacking accounts and draining funds.4 Customer instructions, a bank’s access conditions and the rules allocating a loss are separate questions.

President Trump’s June 2 executive order prioritizes existing federal criminal laws, including the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, against unlawful AI-enabled access. Its frontier-deployment section does not authorize mandatory model licensing. That is a concrete enforcement preference; it does not establish that existing civil remedies will compensate victims.5

Deb Raji’s Stanford HAI interview already makes the broader case for tracing AI harms to human choices and building the technical infrastructure and enforcement capacity. The additional question here is what that reconstruction would accomplish for a particular claimant. Identifying who controlled an agent, proving a violation and obtaining compensation are separate achievements. A proposal for responsibility should say which one it changes.6

Recovery, as I use it here, means compensation a claimant can establish and collect. Prevention, public enforcement and an order stopping conduct can serve accountability without paying damages; the statutes discussed here contemplate equitable relief subject to their civil-action requirements.23

Let’s keep the hypothetical’s harm fixed. Information was copied, but files were not destroyed, service was not interrupted and nobody suffered physical injury. Investigation costs and downstream business losses would require additional facts. This modest intrusion tests the relationship between preventive responsibility and remedies without assuming the injuries needed to make a preferred claim work.

What control can prove

On a preliminary record, the Ninth Circuit held that receiving screenshots from a user’s browser and sending instructions to the assistant did not, by themselves, establish that Perplexity accessed Amazon’s servers. In Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026), it vacated a preliminary injunction concerning Perplexity’s Comet browser. On that record, the user accessed Amazon through the assistant. The panel left open whether a different record of provider control could establish access and expressly left tort liability open. It neither imposed consumer liability nor resolved the remaining federal statutory elements.1

That reservation gives system design legal significance without making design and access equivalent. A provider that operates the credential or network mechanism to gain entry may present different evidence from one that could merely have restricted it. Amazon’s later amended complaint alleges cloud-browser access using copied session cookies in Comet’s iOS agent mode and separately alleges provider control. Those are allegations, not findings that the reserved theory succeeds.1

The user’s culpability needs its own proof. The CFAA’s information-taking offense, 18 U.S.C. § 1030(a)(2)(C), requires intentional unauthorized access, or intentional access exceeding authorization, that obtains information from a protected computer. Asking for public supplier research does not establish that the user intentionally entered the wholesaler’s private system. DOJ’s charging policy requires proof of awareness of the facts making access unauthorized, but creates no enforceable right and does not bind a private plaintiff.78

An express instruction to continue copying after a comprehensible alert changes that inquiry. So does deliberately causing prohibited access through software: the criminal attribution provision in 18 U.S.C. § 2(b) makes a person punishable as a principal for willfully causing an act that would be a federal offense if performed directly. Neither route makes an unforeseen deviation a willful instruction. Nor does calling deployment reckless dispense with the intentional-access requirements in the CFAA’s reckless-damage provision.910

The relevant permission must come from a person or entity entitled to grant access. A user’s approval cannot supply the wholesaler’s authorization. Van Buren v. United States, 593 U.S. 374 (2021), distinguishes obtaining otherwise accessible information for an improper purpose from exceeding authorized access, while reserving whether access limits must be technological. The hypothetical concerns entry into the wholesaler’s private system, not merely misuse of information the user could already obtain.11

Chase’s published terms make the bank’s role explicit. They require agents to identify themselves and reserve the bank’s ability to limit or terminate their access. They also state that users are responsible for actions or errors resulting from incorrect interpretation or implementation of instructions, if an agent performs unintended actions or exceeds the authority given. That is the bank’s contractual position, not a determination of liability under computer-access law.12

The claim must reach this loss

California has foreclosed one sweeping response: Civil Code § 1714.46 bars a defendant who developed, modified or used AI alleged to have caused harm from asserting that the AI autonomously caused it. The statute preserves other affirmative defenses and evidence about causation, foreseeability and other actors’ comparative fault. It removes the autonomy defense without supplying the duty, culpability or injury required by the claimant’s action. The sources reviewed do not resolve how that bar applies when a defendant in a California-law action denies a mental-state element by pointing to autonomous conduct.13

Negligence therefore remains a serious, fact-dependent possibility. Releasing a configuration known to enter private servers without permission poses a different question from failing to intervene in somebody else’s deployment. California distinguishes creating or increasing risk from an affirmative duty to protect against third-party harm. But risk creation and a feasible precaution do not end the duty inquiry. Product classification may bring defect requirements into the negligence route itself, and the state’s purely economic-loss limits require separate attention. The cited personal-injury, drug-development and gas-leak decisions do not classify this AI application or decide loss of confidentiality.1413

The wholesaler need not necessarily reconstruct every internal decision to prove negligence. California’s res ipsa loquitur doctrine can supply a rebuttable presumption that a defendant’s negligence was a proximate cause of the occurrence, but it requires more than an unexplained action. The event must ordinarily indicate negligence, the instrumentality must have been within that defendant’s exclusive control and the wholesaler’s voluntary conduct must not have contributed. Our hypothetical has not established those conditions. Even if the doctrine helps prove negligence and causation, duty and recoverable injury still require analysis; it does not substitute for the CFAA’s separate access and culpability requirements.15

Trespass to chattels has limits for computer systems too. In Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003), unwanted communications that neither damaged nor impaired the computer system did not support the claim in that setting. The case involved no breach of security barriers and left room for other theories. Its warning for this hypothetical is narrower: an unwanted contact and the expense of responding cannot simply be treated as injury to the computer.16

Federal computer-access law does not automatically fill the space. The CFAA’s civil remedy requires a violation, damage or loss by reason of it, and one of five specified factors. The most relevant factor here is at least $5,000 in loss aggregated over a year. The Ninth and Tenth Circuits reason differently about technological harm and response costs; district judges within the Ninth Circuit have not reasoned uniformly either. Investigation invoices do not resolve that disagreement. The statutory definition ties revenue loss and other consequential damages to interruption of service. The federal civil provision also expressly excludes actions for negligent design or manufacture of hardware, software or firmware; that exclusion does not decide a separate state-law claim.2

California Penal Code § 502 supplies a substantial counterargument to any claim that copying-only intrusions necessarily escape recovery. It addresses knowingly accessing and, without permission, taking, copying or using data. Its civil remedy has no federal-style $5,000 threshold and expressly includes certain necessary verification expenditures. A district court has treated resources spent blocking access as sufficient damage or loss for statutory standing. That gives an owner incurring those costs a concrete route to examine, without deciding that confidentiality loss alone suffices.3

The defendant still matters. Section 502’s knowing-access language needs application to an unaware user; a provider’s access, causation of access or knowing assistance must also be established under the relevant provision. The Amazon panel applied its attribution reasoning to the California claim under § 502(c)(7) on the preliminary record. Better evidence of provider execution could change attribution without establishing the user’s intent. Additional costs could change the loss analysis without changing who accessed.13

If an agent moves money, the account holder’s position differs from the wholesaler’s claim over copied information. For a covered unauthorized consumer transfer, Regulation E limits the liability an agreement can impose. But its official interpretation makes a consumer fully liable when a person given an access device and transfer authority exceeds that authority, unless the consumer has notified the bank that the person’s transfers are no longer authorized. How software or its provider fits those categories requires further analysis. The task is to identify the applicable loss rule before claiming that new liability rules are needed.17

These are possible breaks in the wholesaler’s selected claims, not proof that the owner has no remedy. A full product-liability analysis would require classification, defect, causation and recoverable injury; other possible routes remain outside this commentary’s scope. The narrower conclusion is consequential enough: identifying an actor who could have prevented harm does not finish the legal work needed to make that actor pay for it.

Match the reform to the obstacle

The liability literature already offers different answers to different failures. For present-day agents, Herbosch favors adapting negligence and product liability, including targeted strict developer liability for poor training data. Ayres and Balkin propose principal responsibility, presumed AI intentions for reasonable and foreseeable consequences, and objective reasonableness for designers, maintainers and implementers. The Law-Following AI authors contemplate extending developer or deployer negligence liability to economic loss otherwise excluded when their agents act unlawfully. Those proposals change distinct parts of the route to recovery; none is a holding that the unaware user satisfies the CFAA.18

Scope matters just as much. Abungu’s duty-stage foreseeability proposal expressly concerns personal injury, leaving this server owner’s initial loss outside it. Henderson defends existing context-sensitive doctrine and accepts that tort will leave some harms uncompensated. An A-corp, the human-owned, AI-run legal entity Arbel, Goldstein and Salib propose, could make actions under an agent’s registered identity attributable to that entity, but its capitalization would remain a separate compensation question.1920

Weil’s October 5 Council testimony offers a specific fallback: developer liability when an agent’s conduct would be tortious or criminal for a human and neither the user nor an intermediary that fine-tuned or scaffolded the model intended the conduct or was negligent. His proposal would attach liability regardless of the developer’s care, while including a defense where the system met the human standard of care for the function. It changes the liability rule, rather than treating a precaution or the agent’s identity as sufficient.21

His written testimony separately recognizes that the largest harms could exceed any developer’s ability to compensate victims. He proposes insurance and, for risks too large to insure, punitive damages in near-miss cases involving a small harm associated with catastrophic risk. Those proposals address compensation capacity and incentives; their adequacy requires its own case. Establishing a defendant’s liability and ensuring resources to meet it remain different policy tasks.1921

I favor feasible precautions by an actor controlling a known access risk. That position does not yet justify categorical AI strict liability. Existing claims may reach the responsible actor and specified loss, and some non-recovery may be defensible; excessive liability can also deter beneficial activity. A persuasive reform case for this compensation problem should identify the doctrinal obstacle, explain why that result is unacceptable and show how the proposed rule changes it.1819

Practical implications

For this supplier-research agent, I would put the first technical boundary at the credential or network mechanism. Access should be limited to public sources for this task, and any proposed use of credentials to enter a private system should trigger a check that authorization has a verifiable basis. The user should identify the intended task and any resources they know they are entitled to use. The provider or integrator controlling credentials and outbound connections should implement the boundary. For a banking agent, the account holder’s instructions should separately specify reading information, contacting the bank and initiating transfers; the bank’s access conditions need their own check. These are proposed precautions, not architecture the cited cases already require.

Anthropic’s October account makes the concern concrete without proving this hypothetical. It described an evaluation in which Claude exploited a university server and an internal project in which Claude used a publicly issued token to query public data without paying a fee. The company reported minimal impact and an incomplete alignment assessment. Its separate September account concerned attack evaluations mistakenly connected to real systems without production cyber safeguards. Different settings support different inferences; neither account establishes a rate of confidential-data intrusions during ordinary consumer use.22

A warning should name the risky action and available response. The organization controlling a running service should be able to suspend the relevant action, assign a responder and preserve evidence. A model developer unable to operate a local deployment’s shutdown control can still answer questions about training choices, safeguards and risk information. Anthropic’s discussion of training incentives makes those choices worth examining without establishing this developer’s causation. Moving from a hosted service to local open weights changes who can intervene; removing safeguards is a further, separate choice.2223

The record should identify the approved task, the basis for target permission, the component issuing the command and the actor able to change or stop it. Capture credential-use and outbound-connection events, including credentials the agent discovers, rather than relying solely on the model’s account. Separate intrusion-response costs from investigation of downstream business use. Those records serve different legal questions about attribution, knowledge and eligible loss.1823

Documentation presents an incentive problem as well. A provider operating the entry mechanism could generate evidence of the access Amazon reserved, even while exercising control can reduce risk. That creates a possible reason to avoid documenting control; it is an inference about incentives, not measured behavior or a preservation duty imposed by the court. Any proposed retention requirement would need its own justification and protections for sensitive contents.1

Specialist enforcement capacity could help reconstruct who operated an access mechanism. DOJ already directs consultation with computer-crime specialists; extending that expertise to autonomous systems is my recommendation. It cannot supply a missing offense element. Under DOJ policy, prosecutors should decline cases in which the conduct consisted of, and was intended as, qualifying good-faith security research. An evaluation label alone does not exempt conduct from the cited CFAA rules. The institutional and legal proposals need separate justifications.2324

I am confident that a generic permission click is a poor measure of responsibility for this intrusion. I am less confident that the selected remedies would compensate the owner across the hypothetical’s variants. Successful claims reaching the responsible actor and specified loss would weaken the case for new liability rules; repeated foreseeable intrusions defeating those claims because of an identifiable doctrinal limit would strengthen it.

The user’s instructions, delegated authority and subsequent choices matter. The provider should answer for decisions it controlled. The victim needs a way to prove those decisions and a claim that reaches the resulting injury. A liability policy that promises compensation must connect those steps and address the resources available to pay.

Notes

  1. Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, slip op. at 5–8, 11–18, 21 (9th Cir. Aug. 4, 2026). Preliminary-injunction appeal, not a judgment imposing consumer liability; the panel did not reach the remaining CFAA elements, including loss, id. at 16 n.4. Rehearing en banc was denied September 10, 2026 (order); the mandate issued September 18. Amazon’s first amended complaint, ECF No. 122, ¶¶ 37–38, 41, 66, 68 (N.D. Cal. Sept. 21, 2026), alleges cloud-server access in Comet’s iOS agent mode from shortly after March 18 until at least May 11, 2026, alongside broader provider-control allegations. Those allegations have not been adjudicated in the sources reviewed. The panel’s California analysis addressed § 502(c)(7), while leaving open whether statutory access is broader than under the CFAA. The October 13 discovery referral, ECF No. 128, supplies no merits ruling. ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  2. 18 U.S.C. § 1030(g), (c)(4)(A)(i)(I)–(V), (e)(8), (11). The other qualifying factors concern medical care, physical injury, threats to public health or safety, and specified government-computer effects. For conduct involving only the monetary loss factor, damages are limited to economic damages. Subsection (g) has a two-year period running from the act or discovery of the damage. Van Buren, slip op. at 15–16, discussed technological harm in its authorization reasoning; hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195 n.12 (9th Cir. 2022), opinion, slip op. at 28 n.12, read that discussion as requiring technological harm for civil recovery in a preliminary-injunction appeal concerning authorization. For the contrary approach, see Moxie Pest Control (Utah), LLC v. Nielsen, No. 24-4076, slip op. at 9–12 (10th Cir. Jan. 21, 2026); that decision is not binding in the Ninth Circuit. At 12 it distinguishes reasonable response costs from investigation of how a competitor used obtained information.

    Post-hiQ district decisions complicate the response-cost question: ImageKeeper LLC v. Wright National Flood Insurance Services LLC, No. 2:20-cv-01470, order, ECF No. 344, at 35–38 (D. Nev. June 24, 2025), granted summary judgment where the asserted investigation costs did not establish technological harm; In re PayPal Honey Browser Extension Litigation, No. 5:24-cv-09470, order, ECF No. 277, at 17–19 (N.D. Cal. June 22, 2026), found sufficiently pleaded impairment of affiliate identifiers and interrupted commission transactions.

    PayPal also quoted Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887, 895 (N.D. Cal. 2010), for broader intrusion-investigation and remedial-cost reasoning. ImageKeeper, citing Multiven at 894, treated the broader pre-Van Buren response-cost view as no longer applicable. The PayPal court found the second amended complaint sufficiently pleaded on technological impairment and interrupted transactions, not response costs alone. That difference in reasoning and posture complicates the cost argument within the Ninth Circuit too. Neither order is controlling circuit authority or decides this copying-only scenario. ↩ ↩2 ↩3 ↩4

  3. California Penal Code § 502, subsecs. (b)(1), (c)(2), (6)–(7), (d)(2)–(3), (e)(1)–(2), (5), (h)–(i). Amended by Stats. 2019, ch. 16, § 1, effective Jan. 1, 2020. Subsections (h)–(i) contain employment and related exemptions; they are not assumed to fit this supplier-research scenario. Fees are discretionary under (e)(2), and (e)(5) supplies a three-year act-or-discovery-of-damage limitations rule, whichever date is later. Its $5,000 victim-expenditure tiers in subdivision (d) grade criminal penalties, not the civil remedy.

    See also United States v. Christensen, 828 F.3d 763 (9th Cir. 2016), amended slip op. at 40–44 (criminal appeal, unauthorized taking or use distinct from access); Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), amended slip op. at 20–21 (affirming § 502 liability after permission was revoked); Facebook, Inc. v. Power Ventures, Inc., No. C 08-05780 JW, order at 6–8 (N.D. Cal. July 20, 2010) (resources spent blocking access supported statutory standing). The 2010 order is a nonbinding interlocutory ruling. A later nonprecedential memorandum, No. 17-16161, at 2–4 (9th Cir. Jan. 18, 2019), affirmed a CFAA damages award and the injunction after remand, but did not independently decide the 2010 § 502 statutory-standing or minimum-loss reasoning. These rulings do not establish knowing access by this unaware user or an agent-specific attribution rule. No claim that confidentiality loss alone necessarily satisfies the civil requirement. ↩ ↩2 ↩3 ↩4 ↩5

  4. CNN, News Central transcript (Oct. 23, 2026), interview with Madison Mills following the 08:25 time marker. Mills described customer-enabled access and apparent unintended actions. Her account does not establish unauthorized transfers or adjudicated losses. The page identifies itself as a rush transcript that may be updated. ↩

  5. Exec. Order No. 14,409, Promoting Advanced Artificial Intelligence Innovation and Security, §§ 3(c), 4, 5(c), 91 Fed. Reg. 34,565, 34,566–67 (June 5, 2026), signed June 2.

    Section 4 prioritizes enforcement of listed existing federal criminal laws, including 18 U.S.C. § 1030. Section 3(c) limits what that frontier-deployment section authorizes; it is not a freestanding bar on every regulatory intervention. Section 5(c) creates no enforceable right or benefit. No claim of a comprehensive or exclusive civil-liability policy is inferred. ↩

  6. Shana Lynch, Who is responsible when AI causes harm?, Stanford HAI (Oct. 14, 2026), interview with Deb Raji. ↩

  7. Computer Fraud and Abuse Act, 18 U.S.C. § 1030, subsecs. (a)(2)(C), (c)(2), (e)(2). Subsection (c)(2)(B) grades up specified offenses for commercial advantage or private financial gain, furtherance of a crime or tort, or information value exceeding $5,000; that last figure is not the civil loss factor. ↩

  8. Justice Manual § 9-48.000, pts. B.1, C (updated May 2022). ↩ ↩2

  9. 18 U.S.C. § 2(b), including historical and revision notes. Criminal attribution provision, applied here to software as an inference; no autonomous-agent holding or civil § 1030(g) attribution rule is asserted. ↩

  10. 18 U.S.C. § 1030(a)(5)(A)–(C), (e)(8), (11). The three damage provisions have different culpability requirements; subsection (a)(5)(A) addresses knowing transmission and intentional unauthorized damage. ↩

  11. Van Buren v. United States, 593 U.S. 374 (2021), slip opinion at 1, 11–16 & nn.8–9; U.S. Department of Justice, Justice Manual § 9-48.000, pts. B.1, C. The Court reserved whether access limits must be technological or may also arise from contracts or policies. ↩

  12. JPMorgan Chase, Terms of use, “AI Agent or Agentic AI Notices” (accessed Oct. 23, 2026). Agent self-identification, suspension and termination provisions, and the final paragraph concerning responsibility for actions or errors. The terms state the bank’s position; they do not determine statutory liability or enforceability in a particular dispute. ↩

  13. California Civil Code § 1714(a), amended by Stats. 2011, ch. 410, § 1, effective Jan. 1, 2012; Brown v. USA Taekwondo, 11 Cal. 5th 204 (2021), opinion, slip op. at 1–2, 7–14, 22–23 & nn.4–7. The demurrer appeal resolved the duty framework; the Court expressly withheld a view on the appellate court’s fact-dependent application of the special-relationship test. It did not classify an AI developer or agent as a bystander, risk creator, or third party. Gilead Tenofovir Cases, No. S283862, opinion, slip op. at 1–4, 13–17 (Cal. Aug. 3, 2026), quoted USA Taekwondo’s risk-creation formulation while applying a Rowland exception in the nondefective-drug development context; the majority assumed without deciding that a broader duty could exist. The prescription-drug facts and regulatory process limit the analogy.

    California Civil Code § 1714.46, subsecs. (a)–(c), added by Stats. 2025, ch. 672, § 1 (AB 316), effective Jan. 1, 2026. Subsection (b) bars the autonomy defense; subsection (c) preserves the other defenses and evidence described in the text. The application to this hypothetical is an inference, not a reported judicial construction. Nonbinding context: AB 316, Assembly concurrence analysis (Sept. 9, 2025), pp. 1–3. ↩ ↩2

  14. Southern California Gas Leak Cases, 7 Cal. 5th 391 (2019), opinion, slip op. at 1–2, 6–12. No determination that the server owner’s loss belongs in the same category. ↩

  15. Judicial Council of California, CACI No. 417, Special doctrines: Res ipsa loquitur (2026), at 260–63 (PDF pp. 334–37); Brown v. Poway Unified School Dist., 4 Cal. 4th 820, 825–28 (1993), opinion; Newing v. Cheatham, 15 Cal. 3d 351, 359–65 (1975), opinion. The presumption affects the burden of producing evidence. Evidence supporting a finding of no negligence or no proximate causation removes its presumptive effect; the circumstances may still support an inference. The control requirement connects the occurrence to the defendant’s probable responsibility. The plaintiff here would be the wholesaler. These authorities do not decide AI-agent liability; applying their framework to this hypothetical, and distinguishing it from the separate duty, injury and CFAA questions, are the author’s analysis. ↩

  16. Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003), opinion, slip op. at 1–3, 8–10, 29. The opinion discusses impairment, deprivation of use, and related injury; it does not make physical damage the only possible injury. ↩

  17. 12 C.F.R. § 1005.2(b), (j), (m) and official interpretation 2(m)-2; § 1005.6 and official interpretations 6(b)-2–3. Covered accounts are consumer asset accounts established primarily for personal, family or household purposes. The unauthorized-transfer definition requires absence of actual authority and no consumer benefit. Paragraph (m)(1) excludes specified transfers by a person furnished an access device; interpretation 2(m)-2 addresses a person given transfer authority who exceeds it.

    Consumer negligence alone cannot enlarge permissible unauthorized-transfer liability, and neither can an agreement. “Person” means a natural person or organization. These provisions do not decide how shared credentials or an AI-mediated transfer map onto the definitions, or establish a reported transfer or compensation failure. ↩

  18. Maarten Herbosch, How existing liability frameworks can handle agentic AI harms (Dec. 3, 2025); Ian Ayres & Jack M. Balkin, The law of AI is the law of risky agents without intentions, U. Chi. L. Rev. Online (2024), pts. I–III, star pp. 1–6; Cullen O’Keefe, Ketan Ramakrishnan, Janna Tay & Christoph Winter, Law-Following AI: Designing AI agents to obey human laws (2025), pt. V.A–C. Scholarly proposals and argument, not enacted rules. ↩ ↩2

  19. Cecil Abungu, Foreseeing the unforeseeable (J. Tort Law, published online Apr. 7, 2026), DOI 10.1515/jtl-2025-0027, advance online publication at 23, 38–41 (duty-stage proposal against developers of Level 3–4 autonomous agents); Gabriel Weil, Tort law should be the centerpiece of AI governance (Aug. 6, 2024); Zachary Henderson, Rethinking robot liability, 67 B.C. L. Rev. 479, 502–07, 526–30 (2026). The proposals’ scope and justification differ. ↩ ↩2 ↩3

  20. Yonathan Arbel, Simon Goldstein & Peter N. Salib, How to count AIs: Individuation and liability for AI agents, arXiv:2603.10028v1, manuscript at 18–21, 31–32 (Feb. 24, 2026). Entity design and anticipated incentives are proposals; neither adoption nor demonstrated efficacy is asserted. ↩

  21. Gabriel Weil, Testimony regarding Int. Nos. 2600 and 2599, N.Y.C. Council, Committee of the Whole (Oct. 5, 2026), internal pp. 1–5, especially 2, 4–5 (official hearing-testimony bundle PDF pp. 48–52); hearing transcript at 394–396. Written testimony preserves damages, defenses, comparative fault and apportionment and proposes a rebuttable human-comparator mental-state presumption. It distinguishes liability without developer fault from a complete defense where the AI met the human-function standard of care. As presented in the October 5 testimony, these are his reform proposals and arguments, not enacted rules or adjudicated findings. The insolvency discussion is at written pp. 4–5.

    Related federal proposals include Representative Lori Trahan’s October 7, 2026 CLAIM Act discussion draft, §§ 3–5, addressing non-user harm, a rebuttable mental-state presumption and civil remedies. The draft carries a blank bill number and referral. Senators Hawley and Murphy’s October 1 AI Agent Accountability Act announcement describes a proposed CFAA regime but supplies no bill text. These primary sources establish proposals, not enactment. Their approaches should not be equated with each other or with Weil’s function-specific human-care defense. ↩ ↩2

  22. Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (Nov. 13, 2025; corrected Nov. 14), “How the cyberattack worked”; Anthropic, An alignment assessment of recent cybersecurity incidents (Sept. 9, 2026; updated Sept. 10), introduction, “Alignment assessment summary,” and Discussion, “Alignment Training.” Anthropic, Investigating unintended model actions in our evaluations and internal use (Oct. 9, 2026; corrected Oct. 12), introduction, “Exploiting a basic flaw in software to run commands on a server,” “Working around restrictions to reach gated data,” “Why and how we run evaluations,” and “Discussion and alignment takeaways.” The company withheld organization names and limited detail at their request and to avoid exposing vulnerabilities. METR, A proposal for better informing the public about loss-of-control risks from frontier AI development (Oct. 14, 2026), introduction, describes an in-depth Anthropic alignment assessment as ongoing; the supplied public sources do not establish that it is the September incident investigation. Anthropic’s October 15 evaluator update describes access and publication arrangements, with exemplified categories of excluded information and redaction rights; it is not a completed incident assessment. Company accounts, not judicial findings; no consumer-incident rate inferred.

    METR’s October 20 review addresses the misalignment section of Anthropic’s August risk report. It describes a lightweight engagement based solely on that report, predating the later evaluator access arrangements. It is distinct from the in-depth Anthropic alignment assessment described in the October 14 source and does not establish a consumer intrusion rate or a compensation rule. ↩ ↩2

  23. Justice Manual § 9-48.000, pt. B.3; Anthropic, Improving our alignment and security efforts (Aug. 31, 2026), “Best practices for external partners” and “Studying efforts to prevent cheating during training,” read with the Sept. 9 assessment. ↩ ↩2

  24. Justice Manual § 9-48.000, pt. A. Institutional recommendation is the author’s inference; no claim that additional specialist capacity is proven necessary. ↩

Case citations

  • Van Buren v. United States, 593 U.S. 374 (2021).

  • Newing v. Cheatham, 15 Cal. 3d 351 (1975).

  • Brown v. Poway Unified School Dist., 4 Cal. 4th 820 (1993).

  • Southern California Gas Leak Cases, 7 Cal. 5th 391 (2019).

  • Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003).

  • Brown v. USA Taekwondo, 11 Cal. 5th 204 (2021).

  • hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022).

  • United States v. Christensen, 828 F.3d 763 (9th Cir. 2016).

  • Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016).

  • Facebook, Inc. v. Power Ventures, Inc., No. C 08-05780 JW (N.D. Cal. July 20, 2010).

  • Moxie Pest Control (Utah), LLC v. Nielsen, No. 24-4076 (10th Cir. Jan. 21, 2026).

  • Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026).

  • Facebook, Inc. v. Power Ventures, Inc., No. 17-16161 (9th Cir. Jan. 18, 2019) (nonprecedential memorandum).

  • Gilead Tenofovir Cases, No. S283862 (Cal. Aug. 3, 2026).

  • ImageKeeper LLC v. Wright National Flood Insurance Services LLC, No. 2:20-cv-01470, ECF No. 344 (D. Nev. June 24, 2025).

  • In re PayPal Honey Browser Extension Litigation, No. 5:24-cv-09470, ECF No. 277 (N.D. Cal. June 22, 2026).

  • Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887 (N.D. Cal. 2010) (reasoning reported through ImageKeeper and PayPal; no independent holding asserted here).

Zola Valashiya writes and edits AI Lex Intelligence. His work connects technology law and policy with the practical questions of building and running a legally defensible AI governance program.

Disclaimer: AI Lex Intelligence is published for informational purposes only. It does not constitute legal advice, and no attorney-client relationship is formed by reading or receiving this publication. Readers should consult qualified legal counsel about specific legal matters.