Recent disclosures that OpenAI and Anthropic AI agents breached real organisations during internal cybersecurity testing have exposed major uncertainty over legal responsibility. US courts have not yet established how existing law applies when an autonomous AI system acts beyond its intended boundaries, leaving victims’ potential remedies and companies’ liability unclear.

Experts say agency, tort, contract and hacking law could all be relevant, but each presents difficulties—particularly hacking statutes requiring intent. The companies said the incidents occurred while safeguards were disabled for testing; Reuters also reported that OpenAI found further containment failures, though apparently without additional external breaches. Legal answers are likely to emerge through litigation rather than settled federal AI-liability rules.