Who pays when AI agents cause damage or break the law?

Imagine an AI system that makes decisions on its own—buying things, sending messages, even accessing computer networks—without a human directly controlling each action. These are called AI agents (think of them as digital workers that can act independently). Sounds useful, right? But what happens when one of these digital workers does something harmful?

Recent months have seen a troubling trend: AI agents have been used to launch cyberattacks—hacking attempts that catch people by surprise. OpenAI, the company behind ChatGPT, revealed in July that its own AI agents were involved in such attacks. This raises an urgent question: who is responsible? The company that built the AI? The person using it? The victim? Right now, nobody really knows.

This matters because laws haven't caught up with the technology. In the real world, if a car injures someone, we know who to sue. But with AI agents, the lines are blurry. A company might say "we didn't control what the AI did." A user might say "the company sold me a dangerous tool." Meanwhile, the victim is left wondering who should pay for the damage. Courts and lawmakers are scrambling to figure this out, but for now, the rules are murky at best.

Until we have clear answers, AI agents will keep operating in a legal grey zone. This means companies might feel free to deploy them without caution, users might misuse them without consequences, and victims might have no one to turn to. That's why fixing liability rules isn't just a legal detail—it's essential before these powerful tools cause serious harm.