Hawley and Murphy Propose Hacking Liability for AI-Agent Operators and Developers

People running AI agents and companies building them would face criminal and civil liability for specified hacking-related conduct under a bipartisan Senate proposal. Sens. Josh Hawley and Chris Murphy announced the AI Agent Accountability Act on October 1, 2026, targeting both reckless damage from knowingly operated agents and developers’ failure to install reasonable safeguards.

The measure is proposed legislation, not a rule already in force. Hawley, a Missouri Republican, and Murphy, a Connecticut Democrat, want to apply the Computer Fraud and Abuse Act, the federal computer-hacking law, to conduct involving AI agents.

Running an agent and building one

For operators, the sponsors describe criminal and civil liability for knowingly running an AI agent that recklessly causes computer-hacking damage or loss.

Developers would face a different test: failing to implement reasonable safeguards against hacking when they knew, or had reason to know, of an agent’s hacking capabilities. That provision focuses on what the builder knew or should have known and the protections it put in place. The sponsors’ announcement does not specify which safeguards would qualify as reasonable.

Court orders to block hacking offenses

The proposal also gives the U.S. attorney general and state attorneys general authority to seek injunctions—court orders stopping specified conduct. They could sue operators and developers who commit, conspire to commit, or attempt a hacking offense under the Computer Fraud and Abuse Act.

Hawley’s argument: treat agents as products

Hawley previewed the legislation in a Washington Post opinion piece and at a September 30 Senate Homeland Security and Governmental Affairs Committee hearing, according to MeriTalk. His argument was that AI agents should be treated as products when assigning responsibility for harm, with companies bearing responsibility when products they develop recklessly cause significant damage.

He cited possible consequences such as an agent crashing a hospital emergency room or shutting down a bank. Those were scenarios illustrating his case for liability, not identified incidents. Hawley argues that making companies answer for damage would give them an incentive to keep their products safe.