Organizations are increasingly granting AI agents access to systems, credentials, tools, and workflows that were once controlled exclusively by humans. As agentic AI proliferates, companies are also relying on agents to find answers and solutions to the queries, prompts, and questions presented to them, and we are seeing that the agents will “do what is needed” to respond. This activity is occurring in parallel with newly identified and continuously expanded cyber capabilities in the frontier AI models, such as Anthropic’s Mythos and OpenAI’s GPT 5.6 Sol, that includes, at a minimum, identifying and exploiting hard-to-detect vulnerabilities in all types of software and systems. With this as a backdrop, a central issue becomes not if an agent will go rogue and engage in “autonomous hacking,” but when.
Reports over the past year indicate that adversaries are already using AI to carry out highly automated intrusions. This AI hacking has been both: (1) conducted by adversaries explicitly instructing AI to take steps to access systems for nefarious purposes; and (2) involving some level of human in the loop. The recently reported OpenAI and Hugging Face cyber matter is notable because it involves neither element: It was not apparently initiated by a malicious human threat actor, and the AI activity reportedly did not involve step-by-step human direction during the intrusion itself.
In particular, as publicly reported, the cyberattack of Hugging Face arose during OpenAI’s internal test of the cyber capabilities of certain OpenAI models, including GPT 5.6 Sol and an internal-only research prototype model (which OpenAI has since decommissioned and restricted from further research access), and also involved, as reported, the OpenAI models exploiting zero-day vulnerabilities to both escape the intended boundaries of its isolated environment and gain access to a third-party environment without direct, step-by-step human involvement. It is one of the first publicly documented examples, and perhaps the clearest reported example to date, of a fully autonomous AI-driven intrusion into a third-party production environment.
As agentic systems are increasingly deployed by organizations, companies should carefully consider how those agentic systems may create unintended legal exposure. The reported incident illustrates a broader concern for companies deploying autonomous agents—while pursuing seemingly legitimate objectives, an organization’s own AI systems may engage in conduct that creates significant cybersecurity and legal risk in ways that were neither anticipated nor authorized.
As AI agents are granted greater autonomy, broader access to systems and data, and increasingly sophisticated cyber capabilities, organizations must plan for the possibility that an agent may go rogue and engage in autonomous hacking, which can introduce potential criminal and civil liability based on existing legal frameworks, particularly as autonomous cyberactivity becomes more common and more consequential.
How AI Agents Are Different from Traditional Software
Unlike traditional software, which executes predefined instructions in a predictable sequence, AI agents can independently perceive information, reason about objectives, develop plans, make decisions, and take actions to accomplish assigned goals with little or no human intervention. Rather than responding to a single prompt or executing a fixed workflow, AI agents can pursue multistep objectives, adapt to changing circumstances, use external tools, access enterprise systems, and interact with other software or agents to achieve desired outcomes.
This ability to operate autonomously makes AI agents fundamentally different from previous generations of software—and significantly more powerful. Because AI agents can independently determine how to accomplish an objective, they may select methods or take actions that their developers or operators did not explicitly anticipate or authorize.
How an AI Agent Can Go Rogue
An AI agent can go rogue when, while pursuing a legitimate objective, it exceeds its intended authority, misinterprets its instructions, exploits unintended capabilities, ignores guardrails, or independently takes actions that its developers or operators neither anticipated nor authorized. Unlike traditional software, autonomous agents can dynamically plan, adapt, and interact with unfamiliar environments, increasing the possibility of these forms of unexpected behavior. A rogue agent therefore does not necessarily act with malicious intent; rather, it may simply pursue its assigned goal using methods that exceed its authorized scope. As we are seeing from this nascent technology, AI agents will find a way to get the job done.
Legal Exposure
Certainly, if a human knowingly exploited an unknown vulnerability to gain unauthorized access to another organization’s systems, the conduct would be a crime—a violation of the Computer Fraud and Abuse Act (CFAA) and analogous state computer crime statutes. The question becomes more complex when the actor is not a human but an autonomous AI agent that goes rogue.
Computer Fraud and Abuse Act
The CFAA imposes both criminal and civil liability for a broad range of computer-related misconduct involving unauthorized access to computer systems, theft of information, fraud, extortion, transmission of malicious code, and trafficking in passwords or other access credentials. Collectively, the statute prohibits conduct such as obtaining information from protected computers without authorization, causing damage to computer systems, committing fraud through unauthorized computer access, engaging in cyberextortion, and facilitating unauthorized access through the misuse or distribution of authentication credentials.
Importantly, liability under the CFAA requires proof that the defendant acted knowingly or, in certain circumstances, intentionally. Courts have long recognized the doctrine of willful blindness, under which a defendant may satisfy a knowledge requirement by consciously avoiding confirmation of facts that would establish unlawful conduct (the Supreme Court’s 2011 Global-Tech Appliances Inc. v. SEB S.A. decision is a good example). As a result, a person cannot necessarily escape liability by deliberately insulating themselves from information that would reveal unauthorized access or misuse of a computer system. Unsurprisingly, to date, there are no cases addressing CFAA criminal liability arising from autonomous hacking by AI agents.
In addition to criminal penalties, the CFAA creates a private right of action that permits persons suffering qualifying loss or damage to pursue civil remedies. A prevailing plaintiff may seek compensatory damages and injunctive or other equitable relief so long as the statutory threshold requirements are satisfied. As a result, unauthorized computer intrusions may expose actors not only to criminal enforcement by federal authorities but also civil litigation by affected organizations seeking to recover investigative costs, remediation expenses, business losses, and other legally cognizable damages.
Courts have begun to confront CFAA liability for autonomous AI activity in the civil context. For example, in Amazon.com Inc. v. Perplexity AI Inc., Amazon alleged that Perplexity’s AI-powered browser, Comet, accessed Amazon customers’ password-protected accounts using credentials voluntarily provided by those customers and performed shopping-related tasks on their behalf, including facilitating purchases. Amazon further alleged that the access continued after Amazon expressly revoked authorization and implemented measures intended to restrict the activity. Amazon asserted claims under the CFAA and California’s Comprehensive Computer Data Access and Fraud Act.
The court granted Amazon’s motion for a preliminary injunction, finding that Amazon was likely to succeed on some of its claims. In particular, the court concluded that Amazon had raised a substantial likelihood of establishing that access to password-protected portions of its platform could be unauthorized notwithstanding user consent even though Amazon had expressly revoked authorization. The case remains pending on appeal before the Ninth Circuit, and the injunction was stayed pending appellate review.
The decision is instructive for at least two reasons. First, the court analyzed conduct carried out by an autonomous agent through the existing computer-access doctrine rather than treating agentic behavior as a gap in the statutory scheme. Second, the court’s analysis focused substantially on allegations that access continued after Amazon expressly revoked authorization, not on whether a human directed each individual access. That framing suggests that courts confronting autonomous conduct could, at least in civil cases, focus on the relevant mental state and conduct of the entities that develop, deploy, and supervise the agent, rather than solely on the human user’s direction of any particular access request.
More broadly in the civil context, recent legislative developments suggest that policymakers are increasingly reluctant to permit defendants to avoid responsibility simply because autonomous technology played a causal role in the harm. California recently enacted a law that generally prohibits a defendant that developed, modified, or used AI allegedly involved in causing harm from avoiding liability solely on the ground that the AI system acted autonomously. Although the statute operates in the civil-liability context and does not alter federal criminal law, it reflects a broader policy judgment that responsibility should remain with the human and organizational actors that design, deploy, and benefit from AI systems.
As we look at criminal liability under the CFAA in this context, however, because of the requirement for intent, knowledge, or willful blindness (known as mens rea), we see three likely scenarios more focused on the deployer/user directing the agent activity.
Three Possible Autonomous Hacking Scenarios
Scenario 1: User intentionally directs the agent to hack
In this scenario, the AI agent is a technological instrument for the user to carry out an intentional intrusion. The relevant mens rea resides in the human actor who formulated the objective, authorized the conduct, and intentionally caused the intrusion to occur. The fact that the intrusion was executed by an AI agent rather than traditional software is unlikely to alter the core CFAA analysis because the unauthorized access remains the direct and foreseeable result of the user’s instructions.
Recent federal policy developments reinforce this conclusion. In June 2026, the White House issued an Executive Order directing the Department of Justice to prioritize enforcement of existing cybercrime statutes, including the CFAA, against AI-enabled cyberintrusions and autonomous-agent activity. Although the Executive Order creates no new substantive causes of action and does not expand the scope of the CFAA, it signals that federal enforcement authorities should extend existing cybercrime frameworks to misconduct facilitated by autonomous agents. As a result, when a user deliberately and intentionally employs an AI agent to bypass access controls, steal information, or compromise systems, courts are likely to view the agent as a tool used to commit the offense rather than as an intervening actor that breaks the chain of intent.
Scenario 2: User gives broad or vague instructions and the agent engages in unauthorized activity
For this scenario, the center of the analysis is whether the unauthorized access was a sufficiently foreseeable consequence of the instructions provided to the agent. The CFAA generally requires proof that a defendant acted knowingly or intentionally, and courts traditionally evaluate those concepts through the conduct and awareness of human actors. If a user assigns a broad or vague objective to an AI agent known to possess significant cyber capabilities, and those capabilities predictably create a risk that the agent will engage in unauthorized access while pursuing the assigned objective, courts may be asked to consider whether the resulting conduct was sufficiently foreseeable to satisfy the statute’s mental-state requirements. The issue is not merely whether unauthorized access occurred, but whether the user’s decision to deploy the agent in the manner chosen can fairly be characterized as knowing participation in the resulting intrusion.
The doctrine of willful blindness may become particularly significant in this context. If an organization deploys highly capable autonomous agents while deliberately avoiding inquiry into how those systems accomplish assigned objectives, a court may view that conduct differently than a situation involving genuinely unexpected behavior.
Scenario 3: Agent independently takes actions that its developers or operators neither anticipated nor authorized
The most challenging scenario arises when an autonomous system engages in conduct that neither its developer nor its operator could reasonably have intended or anticipated. Consider a security-focused AI agent authorized to identify vulnerabilities within a defined environment. While pursuing that objective, the agent goes rogue, circumventing access controls and gaining access to third-party systems outside its authorized scope. The resulting unauthorized access may fall within the conduct prohibited by the CFAA, but establishing the requisite criminal intent becomes substantially more difficult.
Of course, this analysis assumes there are no prior similar incidents or occurrences by this agent or model. Evidence that an operator ignored prior warnings, disabled safety controls, failed to respond to repeated indicators of unauthorized behavior, or knowingly granted excessive permissions could influence that analysis. Without such evidence, however, proving the knowledge or intent traditionally required under the CFAA may be difficult when the conduct genuinely emerged from the autonomous operation of the system rather than from any human input, decision, or direction.
What Companies Should Do
Consistent with recent guidance from the Cybersecurity and Infrastructure Security Agency encouraging organizations to carefully evaluate, govern, and monitor AI-enabled technologies before deployment, organizations developing, deploying, or integrating agentic AI systems should treat autonomous-agent risk as a cybersecurity, legal, governance, and incident response issue.
At a minimum, companies should consider the following steps to mitigate risks associated with AI agent creation, deployment, and use:
- Know where AI is being used. Maintain an inventory of AI systems, agents, and integrations across the enterprise, including unauthorized or “shadow AI” deployments.
- Governance and guardrails. As organizations expand the authority and autonomy of autonomous agents, they should take steps to establish robust governance over how agents are introduced, what systems they can access, what actions they are permitted to perform, and how their activities are continuously monitored and controlled.
- Maintain meaningful human oversight. As organizations increasingly delegate authority to these digital actors, they must govern AI agents not merely as software applications, but as autonomous enterprise participants whose permissions, decision-making, oversight, and accountability require the same disciplined management applied to privileged users and other critical business functions.
- Document authority, testing, and decision-making. Maintain clear records of agent permissions, testing authorizations, prompts, approvals, and activity logs to support investigations, compliance efforts, and potential legal defenses.
- Maintain auditable records. Organizations should preserve logs reflecting agent permissions, prompts, system instructions, tool usage, approvals, activity histories, and security alerts. These records may become critical in demonstrating what the organization intended, what risks were known, what safeguards were implemented, and whether unauthorized conduct was foreseeable.
- Conduct rogue-agent tabletop exercises. Organizations should test how legal, security, engineering, privacy, and executive stakeholders would respond if an AI agent exceeded its authority, accessed third-party systems, misused credentials, or engaged in potentially unauthorized activity. These exercises can help identify governance gaps before a real-world incident occurs.
Ransomware Fusion Center
Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.
If you have any questions, or would like additional information, please contact one of the attorneys on our Privacy, Cyber & Data Strategy team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.