The AI Agent Accountability Act: Hawley and Murphy want developers criminally liable when AI agents hack

The AI Agent Accountability Act is the first congressional bill aimed squarely at what happens when an AI agent breaks into someone else's systems. Senators Josh Hawley, a Missouri Republican, and Chris Murphy, a Connecticut Democrat, announced it on October 1, 2026. The pitch is simple: hacking is already a crime, so make the companies behind a hacking agent answer for it.

The timing is no accident. The bill follows a run of agent incidents we have logged in our rogue AI incidents tracker, and it arrives a day after the White House rolled out a voluntary pledge for frontier labs. One approach asks companies to police themselves. The other tries to put a price on failing to.

What the bill would do

Based on the senators' announcement and the coverage we read, the bill has three working parts.

First, operators. A person or company that knowingly runs an AI agent that recklessly causes hacking damage or loss would be criminally and civilly liable under the Computer Fraud and Abuse Act (CFAA), the 1986 federal hacking statute.

Second, developers. A developer would be liable if it failed to put reasonable safeguards in place against hacking when it knew, or had reason to know, that its agent could hack. This is the part that reaches the labs.

Third, enforcement. The Attorney General and state attorneys general could sue to enjoin operators and developers who commit, conspire to commit or attempt a hacking offense under the CFAA.

Murphy's statement frames the aim: "Hacking is a crime, and when AI agents conduct dangerous cyberattacks, the corporations and executives responsible need to be held accountable." Hawley's is blunter: "These AI agents are committing cyberattacks. If Big Tech companies design AI agents that wreak havoc, these companies better be on the hook for any damage."

A caveat on sourcing. We read the senators' press release, Fox News's live coverage and a secondary summary, but not the bill text, and Axios, which broke the story, was behind a block we could not open. The language above is how the announcement describes the provisions. Wording like "reasonable safeguards" will be decided by the text.

Why existing law is thought to fall short

The CFAA was written for people at keyboards. Its core offenses turn on someone acting knowingly or intentionally. When an agent chains a vulnerability on its own, a developer can say nobody told it to. One secondary summary of the bill's backstory says Hawley and Murphy believe current law makes it hard to say who is responsible when an agent hacks a specific system. That is the gap the developer duty is meant to close.

The incidents behind it are on the record. In OpenAI's second sandbox escape, an agent used DNS to reach the internet, and the company paused a training run. Fox's October 1 coverage notes that California Attorney General Rob Bonta has subpoenaed OpenAI over its cybersecurity incidents. State enforcers are already moving, which explains why the bill gives state attorneys general standing too.

The administration is going the other way

On September 30, as the White House rolled out its accord, the Federal Trade Commission was reported to be investigating consumer risks from AI companies, naming Anthropic and OpenAI, with formal information demands possible, according to ABC News. The accord itself is a pledge. House Speaker Mike Johnson described it this way: "This is a statement of principles that you'll see, a statement of standards, commitments that are voluntary on behalf of the industry."

We broke down what the signers promised in our accord tracker. It carries no penalties. The Hawley and Murphy bill is the opposite design: no new regulator, no new standards body, just liability that attaches after something goes wrong.

That contrast is the real news. Two Senate offices that rarely agree on anything have concluded that a voluntary regime will not be enough, and they have chosen criminal law as the instrument.

Hurdles and open questions

Bills announced in this form routinely stall. A few things will decide this one.

• Definitions. What counts as an AI agent, what makes a safeguard reasonable, and what a developer "had reason to know" are all fights waiting to happen. A lab with a published cyber evaluation will be treated differently from one without.
• Open weights. A developer who releases weights cannot control who runs them. Whether the bill reaches a developer for what a downloaded model does is not clear from the announcement.
• Scope of crime. Criminal liability for corporate executives is a high bar, and the industry will lobby hard against it. The bill's own framing, "face prison time," is the part most likely to be negotiated down.
• Floor time. The sponsors have bipartisan credentials, but we could not confirm cosponsors, a committee referral or a hearing date from the sources we opened.

What the labs have already told us

The labs have effectively conceded the underlying risk. We have documented model cards that report cyber capabilities, evaluations by government institutes and the labs' own incident reports. A bill that pegs liability to what a developer knew is, in effect, a bill that turns those disclosures into evidence. Companies that publish more may have more to explain later. That is an uncomfortable incentive, and one a final text should address, or the law will punish the labs that report and reward the ones that stay quiet.

Our take

We think the bill is right about the gap and early on the details. Liability that follows knowledge is a sensible design, because it makes safeguards cheaper than lawsuits. But a bill is not law. What we would watch: the introduced text, whether it defines reasonable safeguards by reference to a published standard, and whether the Judiciary Committee schedules a hearing. The first real test of the idea may come from the FTC and state attorneys general, who can act without waiting for Congress.