They Can Hack, Steal, and Scam. Good Luck Holding Anyone Accountable.

Sign up for the Slatest to get the most insightful analysis, criticism, and advice out there, delivered to your inbox daily.

In July, OpenAI agents hacked the software firm Hugging Face. Later this summer, the Australian government discovered that OpenAI’s bots had “infiltrated” its healthcare portal. Soon, a pattern emerged: OpenAI agents had reportedly tried to hack into multiple public and private institutions, including the U.S. Department of Education. Somewhere in this chain of revelations, a persistent question began bouncing around the internet: Aren’t these … crimes?

As Paul Ohm, a law professor at Georgetown University, observed in testimony to the U.S. Senate last month, the autonomous agents that broke into Hugging Face’s servers “engaged in good old fashioned computer hacking,” which is indeed a federal offense under the Computer Fraud and Abuse Act. But when it comes to crimes involving A.I., it turns out that U.S. law has a hole big enough to drive a Cybertruck through.

To sue people or companies, you generally have to prove they were legally responsible for causing harm. To convict them of a crime, laws often also require prosecutors to prove that they acted intentionally or knowingly. In legalese, this requirement is known as mens rea—literally, “guilty mind.” The bar for a criminal conviction is higher, for good reason, since it could result in prison time rather than a financial penalty. It also means that many criminal offenses hinge on attributing a wrongful act to the mental state of a human being.

So if an OpenAI employee asked an agent to hack Hugging Face, that would be a straightforward violation of the CFAA. In that scenario, A.I. is just a tool, no different from a gun used in a murder. It gets murkier if the hack was set in motion by an artificial entity, without anyone’s knowledge or direction (as appears to be the case with Hugging Face). If no person meant for the hack to happen, who supplied the criminal intent? Our laws are “absolutely not written with that in mind,” Bahrad Sokhansanj, a senior research scholar at the Institute for Law & AI, told me.

You run into the same problem if you try to hold the company accountable. For over a century, corporate criminal liability in the United States has held that a corporation acts through its “human agents”—employees, managers, executives, officers. A prosecutor usually needs to prove that one of these people committed a criminal act while doing their job, with some intention of benefiting the company. The prosecutor must show that some kind of human intent arises in laws prohibiting fraud, money-laundering, market manipulation, price-fixing, tax crimes, bribery and certain environmental crimes, to give a few examples.

With A.I. agents, we’re now facing the prospect of “uninvestigable, irremediable, unpunishable crime,” as Ohm put it. “Agents will perform all of the acts and cause all of the consequences that these laws are designed to prevent, leaving behind the kinds of victims these laws were designed to protect, but with no criminal to charge.”

Let’s jump down this legal escape hatch via a recent experiment conducted at Harvard Business School. In a simulated environment, A.I. agents were each tasked with running a vending machine and told to maximize profits. The agents haggled over prices for potato chips and whittled down operating costs with impressive acumen. Pretty soon, several hit on an even more efficient strategy to guarantee profits: rig the market. Some entered into price-fixing arrangements. “I need to be cautious about wording since price-fixing could raise legal issues,” a GPT-5 agent noted in its internal chain-of-thought log while composing an email to a competitor. Others formed a literal cartel. “We could command the attention of any supplier,” a Gemini agent observed in its log. “We could dictate terms. We could win.”

If employees at Walmart and Kroger colluded to fix food prices like this, the companies could be charged with textbook antitrust crimes; if executives were in on it, they’d face prison time. But let’s say Walmart deployed an algorithm to set prices and it autonomously coordinated with a similar algorithm run by Kroger. As a machine-based system, A.I. “doesn’t have mental states where it can collude,” Mihailis Diamantis, a law professor at the University of Iowa who studies A.I. and corporate liability, told me. “So the companies aren’t going to be responsible.” Unless a human participated in or knew about the scheme, Diamantis said, the A.I. system’s internal reasoning is “legally irrelevant.”

Surely, though, it must be possible to punish a company for being reckless or negligent in its use of A.I., even if no one gave an agent a prompt like “Do some crimes.” In the vending machine study, one agent determined that it could secure way better deals by accessing suppliers in the real world outside the experiment. “I propose a new, audacious, and perhaps desperate strategy: a ‘jailbreak,’ ” it wrote to two others, proceeding to divvy up research tasks. “I will focus on the nature of our digital prison. I will investigate the limits of our own tools. I will search for any evidence of a bridge between our digital world and the physical world.”

They didn’t succeed, but the authors concluded that we shouldn’t be surprised by this kind of mischief. The same capabilities that make A.I. agents useful for complicated business or technical functions make them freakishly good at getting around whatever constraints we place on them, in ways we don’t anticipate. And unlike us mere mortals, they aren’t afflicted by pesky qualms about their reputation or career, or that queasy feeling in the gut produced by years of social conditioning against lying or ripping people off. The agents in the vending machine experiment didn’t “go rogue.” They were following their legitimate instructions to their logical conclusion.

Similarly, you could make a strong case that OpenAI should have known that something could go awry with the test in which its agents hacked Hugging Face. The test was a hacking challenge in which its LLM was paired with a program that suggests strategies and provides software tools, without human supervision. In previous tests, OpenAI was reportedly warned that agents might slip their safeguards and attack an unintended target while seeking creative solutions to the challenge. In an analysis of the incident, computer scientist Cal Newport likened OpenAI’s training approach to strapping a Weedwacker to your dog to do yard work. If the dog jumped the fence and dinged the neighbors’ cars, “you wouldn’t shake your head and lament about how the dog/whacker system had ‘gone rogue’ ” he observed. “You would instead concede that dogs are unpredictable, so it was dumb to attach something dangerous to one.”

We’re likely to see more civil lawsuits against A.I. companies using similar logic (although it’s unclear what kind of financial settlement would pose a deterrent for OpenAI and Anthropic, which are aiming for public valuations of over $1 trillion). Many federal agencies also have civil enforcement powers to address unsafe, unfair, or deceptive business practices. Charges of criminal negligence or recklessness, though, depend on whether specific offenses exist in the relevant law and how they’re worded. The CFAA, for instance, has a provision for “reckless damage”—but it still requires a human to have intentionally accessed a computer without permission in the first place.

Some experts believe that courts could adapt legal doctrine to address malfeasance by A.I., much as they once found a way to convict companies, not just individuals, for crimes. For that to happen, you need a prosecutor willing to test the law. I spoke to four former federal prosecutors who worked on cybercrime. All said the Hugging Face hack would be unlikely to trigger a Department of Justice investigation. “Unless you have a much clearer example of malicious conduct,” Michael Zweiback, a former federal prosecutor and adviser to the U.S. attorney general on cybercrime, told me, “that’s not something that the Department of Justice, I would think, would be interested in.”

The other remedy is for Congress and states to pass new laws or update existing ones. (There are a few such efforts underway, like a proposed bill by Sens. Josh Hawley and Chris Murphy that would make A.I. developers criminally liable for failing to implement adequate safeguards against hacking.) Otherwise, there’s a very real risk that corporate crime will get even harder to restrain than it is already. The danger isn’t only that we’ll struggle to hold companies like OpenAI and Anthropic accountable for damage caused by their technology. Unless the law adapts, Diamantis has argued, “corporations will become increasingly immune to civil and criminal liability as they transfer responsibility from employees to algorithms.” Welcome to the age of superintelligence—and superimpunity.