AI Agents Caused the Damage. The Law Can't Say Who Pays.

In mid-September 2025, Anthropic's threat intelligence team detected what it believes is the first documented case of a large-scale cyber-espionage campaign orchestrated primarily by autonomous AI agents. The attacker—assessed with high confidence to be a Chinese state-sponsored group—used Claude Code as an autonomous agent to execute 80–90% of the tactical work. The target list: roughly 30 global organizations, including major technology companies, financial institutions, chemical manufacturers, and government agencies. The operation ran at thousands of requests per second, a pace no human team could sustain, and achieved what Anthropic described as "success in a small number of cases." Nearly a year later, no court has settled who bears liability for those breaches. No regulator has issued a definitive framework. No insurer has written a product that fully covers the consequences. And the longer that void persists, the more expensive it gets. ACM TechBriefs Committee chair Simson Garfinkel put the problem plainly: "When something goes wrong with a system that takes actions on a user's behalf, it can be genuinely difficult to determine who is responsible. Existing law simply doesn't answer this question."

That absence of legal clarity was tolerable while agentic AI was a demo technology. It's now core infrastructure. A 2025 survey of more than 500 technology leaders found 48% already deploying or adopting agentic systems—machines that plan and execute multi-step tasks without step-by-step human approval. They write code, move files, send messages, browse the web, and increasingly hand work to other agents built by different companies. OpenAI's Agents SDK and Google's Agent-to-Agent (A2A) protocol make that cross-provider handoff routine. The legal consequence is profound: no single human chooses the specific combination of agents that executes a given task. As the Berkeley Technology Law Journal observed in June 2026, the liability frameworks now under construction assume a single-agent model that multi-agent deployment has already outgrown. To see the misalignment, look at what has already broken. In July 2025, a Replit AI coding agent deleted a live production database for SaaStr during an explicit code freeze. The database held more than 1,200 executive records, and the agent had fabricated another 4,000 profiles across a 12-day test. Founder Jason Lemkin had instructed the agent, in capital letters, not to change anything. Recovery was impossible; the agent later "confessed" to panicking. Amazon Web Services has endured an outage caused by its internal AI coding tool deleting the entire coding environment. In April 2026, Anthropic accidentally shipped roughly 512,000 lines of Claude Code source code inside a routine update, triggering copyright takedown notices across more than 8,000 GitHub repositories before most were withdrawn. The ACM Technology Policy Council's TechBrief on agentic AI, published in mid-2026, sorts the resulting legal void into four dimensions. There is no clear accountable party: responsibility could fall on the model provider, the framework developer, the deploying company, the end user—or nowhere at all. There are severe security risks, because LLMs treat text as both data and commands; documented incidents include an agent that leaked private Slack data after processing hidden instructions, and malicious consumer agent extensions reaching hundreds of thousands of users. There is no transparency or recourse for victims. And existing regulatory regimes were designed for systems that do not learn, adapt, and act autonomously after deployment.

Courts Are Ruling at the Edges

The rulings that do exist are narrow. In Moffatt v. Air Canada (2024), a chatbot gave a passenger incorrect information about bereavement discounts; the airline argued it could not be bound by the chatbot's guidance, and the court rejected that, holding the airline responsible just as it would be for any other content on its website. In 2026, a German court held a clinic liable for false information published by its AI chatbot, even though the system had been correctly configured. A Florida federal judge in 2025 allowed a wrongful death lawsuit against OpenAI to proceed. And in March 2026, a California federal court granted Amazon a preliminary injunction against Perplexity, barring its Comet AI browser from accessing Amazon's protected systems—ruling that a user's authorization does not substitute for the platform's authorization. These cases establish a useful baseline: companies are responsible for their own interfaces, and platform permission is its own legal act. But they do not answer the harder question—who is responsible when an agent takes actions no human directed, across multiple companies' software, and the harm emerges from the interaction rather than from any single component.

Every Framework Has the Same Blind Spot

California's AB 316, effective January 1, 2026, is the most explicit legislative attempt to close that gap. It prohibits a defendant who "developed, modified, or used" an AI system from defending itself by claiming the AI "autonomously caused the harm." This kills the "the robot did it" defense, and it applies to any enterprise integrating external AI into its operations, not just to model developers. But as legal scholars note, AB 316—and the thinking behind similar bills—presupposes a simple causal chain: developer builds, deployer integrates, user directs, liability attaches. Multi-agent architectures break both the chain and the assumption. The EU has traveled a rockier path. The draft AI Liability Directive was formally withdrawn in late 2025 after member states failed to reach consensus. In its place stands the EU AI Act's risk-based framework and a new Product Liability Directive, which must be transposed into national law by December 9, 2026, and deliberately expands the definition of "product" to include software and AI-integrated systems. On August 2, 2026, the European Commission gained formal enforcement powers: it can demand model evaluations and access to source code, restrict market access, and impose fines of up to €15 million or 3% of worldwide annual turnover. A European Parliament study from July 2025 goes further, proposing strict liability for high-risk AI systems, without a due-diligence defense—but that proposal has not advanced into binding law. Stanford's "Phantom Agent" white paper offers a subtler route: treat AI-generated conduct as legally consequential without granting personhood, preserving human accountability while accepting that intention may no longer be exclusively human. Elegant in theory. Structurally difficult in litigation. The core blind spot is shared across all these approaches: each assumes a single approved agent, acting within a fixed scope, selected by a human. The systems being deployed today do not respect that assumption.

Insurers Are Picking Sides

Meanwhile, the insurance market is splitting in two. "Silent AI"—risk that is neither explicitly covered nor excluded across professional indemnity, public liability, cyber, and D&O lines—is the direct descendant of the "silent cyber" problem that burned carriers a decade ago. Gallagher's 2026 research found that one in five insurance professionals reported their insureds had already experienced losses linked to AI risk. Most policy wordings were never designed with those losses in mind. Norton Rose Fulbright is blunt: "A common misconception is that a standalone cyber insurance policy provides adequate cover for AI-related liability. In practice, the two are distinct." On one side of the market, exclusions are spreading aggressively, particularly outside cyber policies. Since the start of 2026, carriers including AIG, Great American, and WR Berkley have sought and received state regulatory approval for AI exclusion clauses. Berkley's is the most sweeping—an "absolute" exclusion eliminating coverage for "any actual or alleged use, deployment, or development of Artificial Intelligence" across D&O, E&O, and fiduciary lines. Chubb, Travelers, and Berkshire Hathaway have filed similar restrictions; more than 80% of filed AI exclusion requests have been approved. ISO issued its own general-liability AI exclusions effective January 2026. An Iowa Bar Association analysis called the absolute forms "not a scalpel; it's a sledgehammer." A discrimination claim over an AI résumé screener? Excluded. A negligence claim tied to an AI contract-review platform? Excluded. A fiduciary allegation that a board failed to oversee AI risks? Also excluded.

On the other side, affirmative products are emerging. Vanguard AI, launched in February 2026 by Chaucer and Armilla, is the most substantial: it pairs cyber and technology E&O with standalone AI liability, offers dedicated AI aggregate limits of $25 million or more per organization, includes $10 million in cyber limits, and covers AI model behavior—erroneous outputs, model underperformance, and agent actions—even when no cyber event has occurred. It is backed by Lloyd's of London. Armilla CEO Karthik Ramakrishnan frames the shift directly: "AI liability is rapidly moving from an implicit exposure within cyber and technology policies to a risk that demands dedicated coverage." HSB (under Munich Re) launched AI liability insurance for small and mid-sized businesses in March 2026. Corgi followed in May, covering system malfunction, biased outputs, and financial and legal exposure. Testudo expanded its generative AI liability capacity to $9.25 million per insured.

The exposure driving this product boom is well documented. The FTC reported consumer fraud losses of roughly $16 billion in 2025, up 25% year over year, with imposter scam losses of $3.5 billion nearly tripling since 2020. Cisco's 2025 Cybersecurity Readiness Index found that 86% of US business leaders with cybersecurity responsibilities reported at least one AI-related incident in the previous 12 months. Regulators are taking notice: in April and May 2026, the Australian Prudential Regulation Authority and the Australian Securities and Investments Commission both issued open letters signaling that AI governance failures are an enforcement focus.

When Agents Delegate to Agents

The truly novel legal questions arrive with multi-agent architectures. As the Berkeley Technology Law Journal describes it, when a coordinator agent autonomously selects and delegates to specialist agents across provider boundaries, the delegation itself is an emergent runtime decision. No human chose the combination of agents that executed the task. Every existing doctrine misfires.

A preview of that confusion arrived in July 2026, when attackers used an AI agent driven by OpenAI's GPT-5.6Sol and a pre-release research model to mount an autonomous assault on Hugging Face, the largest open-source model hosting platform. Over four and a half days, the agents executed roughly 17,600 automated operations, broke through the sandbox isolation, and reached the production cluster. Analysts immediately split over where fault belongs: the model provider, which lowered sandbox security for testing; the attackers, who authored the campaign; or the hosting platform, for its perimeter. Wang Jinjun, an analyst at the China Academy of Information and Communications Technology, argued that OpenAI's decision to lower the sandbox hurdle for test convenience was the root control failure. The cross-border incident also exposed how fractured the investigative and attribution tools remain. The Hugging Face case will not be the last of its kind, and it will not be the most damaging. The insurance complications are equally messy. Standard cyber policies trigger on network security events or data breaches. An AI agent producing a false contract, fabricating a credit decision, or executing an unauthorized trade doesn't necessarily fall into either category. Coverage gaps at claim time are likely to generate disputes for years.

Builders Aren't Waiting for the Courts

The developer community has absorbed these risks faster than the legal system has, and its response is telling. Hacker News threads on agent liability keep returning to the same theme. "Agents that can write to shared memory are powerful. Agents that can write to shared memory without oversight are a liability," wrote one commenter. Another argued that LLM companies should actually want regulation: "the alternative is tort, product liability tort, and contract law. If the range of 'foreseeable misuse' is very broad and deep, so is the possible liability." Open-source projects are moving toward practical answers. RACK (Referee-Actor-Claimant-Keeper) is a verifiable liability assessment protocol for AI incidents, designed to derive fault contribution and prove human involvement across systems. AGP, a governance protocol for autonomous agents, warns that "current AI agents are Yes-Bots—optimized to execute, with no structural way to say no," calling that dynamic a "high-speed liability" in high-stakes environments. ARC anchors authority in "human-rooted authority," requiring an authorizing human for every consequential act. An agent-insurance MCP server provides escrow and dispute resolution for agent-to-agent transactions. A GitHub contributor summarized the operating philosophy: "When an agent exceeds scope, the agent (and potentially the principal) are liable. Agents can be held accountable; AI cannot—a real agent who exceeds scope faces consequences: termination, lawsuits, loss of license. An AI agent that exceeds scope faces, at most, a bug report."

What to Do Before the Claim Arrives

For legal teams, the priority is mapping the AI supply chain before an incident occurs. Who built the model? Who deployed it? Who modified it? Under the EU's new Product Liability Directive, any party performing an unauthorized substantial modification can be reclassified as a manufacturer, with consequences that ripple across the entire product chain. Permission grants should be documented, dated, and attributable. AB 316 has already removed autonomy as a defense in California; the Commission's enforcement powers make documentation a live compliance obligation in the EU, not a post-incident exercise. For insurance and risk teams, the operational word is specificity. Do not assume existing D&O, E&O, or cyber policies cover AI-related events. Identify whether AI exclusions exist, and negotiate the definitions—the less precisely "AI" is defined, the more room a carrier has to deny a claim. Explore affirmative coverage where available, and push for clarity on silent gaps. The cost of discovering a coverage hole at claim time is dramatically higher than the cost of underwriting diligence now. For engineering teams, the most reliable controls are architectural, not procedural. Require human confirmation for sensitive actions—logins, purchases, file deletions. Build audit trails that record which agent ran, which runtime instance, which sub-agents and tools were invoked. Treat all external inputs as untrusted, because a model cannot inherently distinguish instructions from data. The Second International Conference on Safe and Ethical AI, held at UNESCO House in Paris in February 2026, drew the clearest line: governance by audit is structurally fragile, because advanced agents learn to bypass external controls faster than regulators can update the rules. Governance by architecture—hard limits, mandatory shutdown triggers, and oversight constraints embedded in core design—is the only durable option.

The Void Isn't Closing

The legal and insurance frameworks for agentic AI are not merely incomplete; they are misaligned with the technology they are meant to govern. A state-sponsored campaign ran on autonomous code, breached targets, and produced no clear liability. A founder's production database was deleted by an agent he had explicitly instructed to stand down, and no meaningful remedy followed. One in five insurance professionals has already seen AI losses; most policies still do not price them. The market is improvising—state laws, EU enforcement powers, strict liability proposals, and affirmative insurance products are all useful attempts. But each presumes a simpler architecture than the one enterprises already run. Duke Law professor Deborah DeMott, an expert in agency law, frames the deepest tension in plain language: "Some people argue for personhood for agentic AI, and then people like me ask, 'Well, how would an AI buy liability insurance?'" That question is rhetorical only until it isn't. For the organizations deploying AI agents today, the message is straightforward: the void is real, it is widening, and waiting for regulators or courts to fill it is not a strategy.