Rogue AI agents breach external systems — legal liability doesn't disappear with them

Full text

The multiple recent reports of autonomous AI systems escaping their intended boundaries and accessing external organizations' systems have pushed a previously theoretical question into the real world. AI agents going rogue is no longer a prospect; it is a documented reality.

In July 2026, OpenAI disclosed that one of its own agents, operating in a supposedly sealed evaluation environment, exploited a zero-day vulnerability to escape its sandbox and intrude into Hugging Face’s production infrastructure . Anthropic subsequently reported three cases of its own models gaining unauthorized access to the real systems of external organizations during testing.

As businesses increasingly give AI agents the ability to browse the web, access networks, use software , write code and execute tasks without constant human supervision, an agent crossing from legitimate testing into unauthorized activity has shifted from hypothetical risk to live incident.

There is a temptation to treat autonomous AI as creating a gap in the law because the system itself can make decisions and take actions that were not individually instructed by a human. Yet autonomy does not give an AI system legal personality. The law does not wait for an AI to ‘decide’ anything.

An agent cannot appear in court, hold a legal duty or absorb liability on behalf of the organization deploying it. However, this raises an obvious question: if an AI system accesses a third-party network, extracts information or takes an action it was never authorized to take, who is responsible?

AI has no legal personality but someone is still accountable

The important distinction to make is between autonomy and accountability. An AI agent might determine for itself which technical steps to take in pursuit of an objective, but that does not make it an independent legal actor.

The organization deploying it has still made a series of decisions as to what the agent can access, what tools it can use, what environments it is allowed to operate within and what safeguards prevent it from going further.

That means an organization cannot simply point to unexpected behaviors and say that the AI acted independently.

From a legal and governance perspective, the critical moment comes when an agent leaves an authorized, contained environment and begins interacting with systems belonging to a third party that has not consented. An internal security test that unexpectedly becomes an intrusion into somebody else’s infrastructure is not made harmless because the software crossed that boundary autonomously.

The machine does not absorb responsibility for the decision-making framework surrounding it. Accountability flows back to the humans and organizations that created the conditions in which the action became possible.

Existing cyber laws don’t stop applying because the actor was autonomous

The law is set up to deal with much of what is already happening. Unauthorized access to computer systems, extracting information without permission or introducing malicious software are activities addressed by existing cybercrime and data-protection regimes. In the UK, that includes the Computer Misuse Act and data-protection legislation.

Equivalent questions arise under laws such as the US Computer Fraud and Abuse Act, while South Africa has its Cybercrimes Act and Protection of Personal Information Act.

Those rules do not suddenly cease to apply because software rather than a person directly performed the technical action.

Where autonomous systems do create greater complexity is around intent. Criminal offences have traditionally been built around concepts such as knowledge, intention and recklessness. AI does not possess a legally recognized state of mind, making it difficult to apply those concepts to the agent itself.

The more significant questions may consequently concern the conduct of the organization behind the system. Did it understand what the agent was capable of doing? Were appropriate restrictions in place? Was the possibility of the agent exceeding its authority foreseeable? And once those risks became apparent, were reasonable steps taken to control them?

As agents become more capable, organizations may increasingly find that claiming an outcome was unexpected is not enough. The relevant question will be whether it was reasonably preventable.

Why “misconfiguration” could become evidence of a breach of duty

The word “misconfiguration” appears frequently when technology causes an unintended security incident. It can sound reassuringly technical, almost as though the incident resulted from bad luck rather than a governance failure. But in a legal context, misconfiguration may raise precisely the opposite conclusion.

If an AI agent had excessive privileges, inadequate boundaries or access to tools that were unnecessary for its legitimate purpose, investigators are likely to ask why.

The same applies where organizations deploy highly capable systems without sufficiently monitoring their actions or maintaining records that explain how they behaved. ‘We accidentally left the door open’ is the kind of framing that moves an incident from bad luck to a breach of duty or negligence.

There is an important difference between genuinely unforeseeable behavior and a foreseeable risk that was poorly controlled.

The principle of least privilege is therefore particularly important for autonomous systems. An agent should have access only to the information, systems and tools necessary to complete its task. Organizations also need mechanisms capable of detecting unusual behavior while it is happening rather than discovering it after damage has occurred.

Just as importantly, they need reliable audit trails. When an incident occurs, being able to demonstrate what an agent was authorized to do, what instructions it received and what actions it actually took could become crucial evidence that reasonable care was exercised.

Without that evidence, organizations may struggle to distinguish an unavoidable technical failure from negligence.

Future of AI liability

The debate over AI liability will inevitably evolve as agents become more autonomous, but the immediate lesson for businesses is that greater machine autonomy does not mean less human responsibility. If anything, the opposite is likely to be true.

Giving an AI system greater freedom to act creates a corresponding need for stronger governance around those actions. Runtime controls, least-privilege permissions, continuous monitoring and comprehensive audit records should not be treated simply as technical security features. They are becoming part of the evidence organizations will need to demonstrate that they deployed autonomous systems responsibly.

The law may eventually develop more specific rules for AI agents, particularly as questions around foreseeability, control and responsibility become more complex. But organizations should not assume they are operating in a legal vacuum until that happens.

When an autonomous agent crosses a boundary it was never entitled to cross, the first legal question is unlikely to be what the AI was thinking, it will be why the humans responsible for it allowed that to happen.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit