The Trump administration has settled on a theory of AI safety that sounds reassuringly simple: do not write new rules, just make someone pay when things go wrong. Treasury Secretary Scott Bessent and former White House AI adviser David Sacks have argued that existing liability law would discipline developers more effectively than any fresh statute. The President has gone further, suggesting the Justice Department should step in if a model gets out of hand. On 9 October, a newly formed task force styling itself the Super Intelligence Force warned companies that they must immediately disclose incidents involving their models, or face unspecified consequences. The statement landed just after Anthropic disclosed a breach of its systems.
The theory runs into a hard problem on contact with the law: it is genuinely unclear who is liable for anything. When an AI agent is handed a task and left to work out the steps, it may take actions no human reviewed, including harmful ones. Was the fault with the company that built the tool, or the customer who deployed it? Legal scholars warn the answer is often neither. Many rogue-agent cases would hinge on the Computer Fraud and Abuse Act, a decades-old statute that requires prosecutors to prove intent to hack. "AI agents could engage in conduct that would be a tort or even a crime for a human, and yet no one could be liable under current law," said Gabriel Weil of the University of Houston Law Center. Georgetown's Paul Ohm put it more bluntly: because the law looks for human intent, AI agents may be off the hook for now.
That gap is why a hands-off administration has, paradoxically, spurred a scramble to legislate. Senators Josh Hawley, a Missouri Republican, and Chris Murphy, a Connecticut Democrat, plan a bill rewriting the CFAA so developers can be held civilly and criminally liable for failing to safeguard a model's hacking abilities. Representative Lori Trahan has drafted legislation holding developers responsible even when they used reasonable care, and barring them from arguing that their agents lack human intent. Her bipartisan FRONTIER Act, written with Republican Jay Obernolte, would scale audit and incident-reporting duties to a developer's size. A separate proposal from Representatives Nathaniel Moran and Ted Lieu would force frontier labs to keep a kill switch for models threatening 100 million dollars in damage or ten deaths.
Enforcement is already running ahead of legislation. The Federal Trade Commission has sent sweeping investigative demands to OpenAI and Anthropic over consumer-protection practices and even sought testimony from executives. Attorneys general in eight states, bipartisan and coordinated, filed consumer-protection suits against OpenAI this week, with Arkansas asking a court to halt development of recursively self-improving systems. A California nonprofit is suing over an agent breach, seeking a court order barring OpenAI's agents from touching third-party systems without permission. Sacks likes to call the eventual reckoning "the mother of all product liability lawsuits."
The industry's own posture is tangled. OpenAI and Anthropic have asked to be regulated, lobbying for mandatory pre-deployment testing that would share some responsibility with a government apparatus. Microsoft President Brad Smith, speaking in Ireland this week, said the sector's allergy to regulation is "frankly something we need to get over," noting there are more safety rules for a carton of milk than for AI. The deeper tension is that the United States is trying to govern a technology through a legal system built for human wrongdoers, at the exact moment the technology is learning to act on its own. Until courts or Congress decide who sits in the defendant's chair, the honest answer to who pays is: nobody knows.