CyberScoop examined which US laws could actually hold AI companies accountable as agentic hacks go "from unprecedented to seemingly routine", speaking with members of Congress, former federal prosecutors and cybersecurity attorneys — and finding no clear-cut answer. The Computer Fraud and Abuse Act (CFAA), long criticised as overly broad, is for once too narrow: former DOJ Computer Crime and Intellectual Property Section cyber unit head Leonard Bailey said he "would not be looking at a CFAA charge as the statute exists today", because prosecutors must prove the defendant knew the access was unauthorised — amenable to humans, but awkward when the "defendant" is a model. Georgetown law professor Paul Ohm, testifying about the Hugging Face hack at a Senate hearing this week, argued that swapping "AI agent" for "OpenAI employee" in the incident reports would read like a criminal indictment containing the defendant's own confession. Other paths floated include FTC enforcement framing unauthorised agentic hacks as unfair or deceptive practices, civil suits, state regulators and new legislation — each with complications. Directly relevant to the OpenAI agent incidents now under investigation in Australia.

• Source article