Really excited to be part of @just_security 's series on Filling the Accountability Gap in AI Governance. My contribution is about the gap in anti-hacking law exposed by the OpenAI–Hugging Face incident. There’s a case for applying existing anti-hacking law, but there are challenging obstacles on whether to courts can assign intent to corporations that make these it hard to use it. (Interestingly, while the article is focused on the U.S. Computer Fraud and Abuse Act, similar issues appear to exist in UK and Australian laws—as well as state anti-hacking laws like California's CDAFA.) That’s why the article calls for amending the law to reach developers and deployers who recklessly cause unauthorized access through autonomous AI agents. An important point to keep in mind is that clearer rules can benefit both potential defendants as well as the public. A proposal like this has been put forward by @HawleyMO and @ChrisMurphyCT. While a lot of people are nervous about expanding the CFAA, it's important to keep in mind that this gap isn't going anywhere, and this approach isn't incompatible with reasonable safeguards against entrapping innocent people in CFAA violations (such as requiring that there be circumvention of technological barriers to access and keeping the standard at recklessness).

I admit I had a lot of skepticism about the Citrini-Anthropic collab, but the fact it gave them this insight has made me come around. More people should be exposed to this. I too was once a cocky computational biophysicst who thought biology was solvable, and then I tried out some wet lab work and the experience was humbling (and humiliating). Biology is very hard for a lot of reasons, and it starts with massive complexity and lack of accurate measurement methods—AI can help here but it doesn't instantly solve problems. And also time—disease can be a slow process, so just collecting data can take years, and the sample size can be tiny or even n=1.

This is fair descriptively. So, given what it we've seen in the last few years, what happens if the executive becomes exponentially faster and less formally deliberative than the legislative process, especially with nearly complete adoption of the unitary executive theory?

This is true for all kinds of potential misuse risks—including bioterrorism. That isn't to say that there is never any bioterror uplift, or that experts who study it aren't thoughtful, but a lot of generic AI folks use mental models overly informed by who they are themsleves.

Maybe I'm missing something but isn't this sort of beside the point when most people accessing accounts are using CUAs or browser agents? I think only a few banks have connections with agents anyway? If anything this pushes people into doing less safe things.

It's worse than that. Even if the account holder’s the only victim, being “made whole by the AI company” assumes AI agent and model providers can actually be held liable. But these companies apply terms to users of agents—who may well be the victims here—that limit what companies owe and make it hard to recover losses. I used Claude and ChatGPT to do some research. For U.S. consumers, many companies shipping agents require binding individual arbitration and waive class actions, including Meta (Muse), OpenAI (ChatGPT / Dots), Microsoft (Copilot), Perplexity (Comet), Amazon, and Instinct. Amazon reinstated arbitration in August 2026 after previously dropping it following mass arbitration claims over Alexa. And then we get to limits on liability. Microsoft limits recovery to one month’s service fee, or $10 for a free service. OpenAI’s cap is the greater of $100 or twelve months of fees. Meta’s Muse terms use the greater of $250 or twelve months of fees. Other providers have similar caps. This is trivial compared to potential financial losses. Of course, some companies’ clauses do explicitly make exceptions for gross negligence or willful misconduct. But state law often limits what companies can contract away anyway, so that isn’t much of a concession. It’s going to be very hard for victims to demonstrate this, Companies will likely argue that they gave enough instructions and warnings to users and weren’t *grossly* negligent, even if they made some mistakes in how they designed agents and their guardrails. AI companies are also putting responsibility for the agent’s actions squarely on the user. Muse’s terms say users bear the risk of financial loss from its transactions. OpenAI says users are responsible for transactions made on their behalf. The terms governing Grok expressly cover agent interactions with financial institutions and disclaim liability to the fullest extent permitted by law. Now, Musk has said SpaceX would make Grok Bot users whole for things like inadvertent purchases or leaks in credit card information. But that promise isn’t reflected in Grok Bot’s written terms. Instead, they put responsibility on the user and exclude liability for agent actions except for losses directly caused by gross negligence or willful misconduct. Taking this all together, the billions of dollars in financial losses scenario isn’t complicated by only whether an AI company has enough money to compensate everyone. The point is that if these terms are enforced, companies may be able to limit what they owe—and prevent users from bringing claims together, which is often what makes taking the case viable for plaintiffs’ lawyers. The bottom line is that an AI company doesn’t even have to go bankrupt for victims to be left with the losses.

People are already connecting AI agents to their bank accounts. Simply freaking out over this risks making policy errors. So what should we do? This isn't really surprising to anyone who goes out in the world and talks to people. I've heard first-hand about folks doing this. (Computer use agents don't need APIs and can essentially interact with a system like a person.) Many people know this is risky. I've also talked to people who stopped because something went wrong, or who got nervous about rogue behavior after the Hugging Face incident was reported. A major reason banks are concerned is that they don't want to be on the hook when a customer claims that something was done by a rogue agent or an agent that accessed their account without their authorization. The "ban on third-party agents" is also an attempt to avoid responsibility when customers use them. We’re already seeing suggestions that this is because AI companies are being too profligate in allowing access to agents, and only certain companies’ agents should have privileged access to important services like bank accounts. That, of course, would mean creating a cartel of agent companies—or, worse yet, allowing frontier AI companies to dominate by being the only source of trusted models. We can do better with policies that address the real issues. Here are some principles that I’ve been thinking about: 1. We should be selective about where we impose the most serious regulations on agents, including requirements for identifiability. Bank accounts are a good place for that, because accessing and moving money are important, and we have a lot of measures in place to track money laundering and terrorist financing that rely on monitoring account activity. And if people are concerned about anonymity, banks are already a place with diminished expectations of privacy. 2. At those points, we should require the ability to: a) establish who authorized an agent; b) determine the scope of delegation—what the agent was authorized to do; and c) track what it actually does. That helps prevent harm and makes it possible to investigate potential wrongdoing. Agent permissions need to be limited and revocable, with technical controls that enforce those limits independently of user instructions. 3. We need to establish clear rules on liability. Right now, for example, Meta forces users into binding arbitration and limits liability (though many state laws at least require Meta to account for gross negligence or worse). So, who do users have recourse against when an agent does something Meta presents in a TV ad as perfectly reasonable, and users assume Meta provides guardrails for it (and maybe some tiny letters at the bottom saying “users are responsible for actions” or whatever)? Updating consumer protection laws to protect both users and third parties is essential. Banks, agent providers, and customers all make decisions that affect the risk—and if everyone disclaims everything, then users and injured third parties will be stuck with losses, and where they can't afford them, those losses risk being socialized. 4. As I’ve written before, when agents actually break into systems, developers and deployers shouldn't escape consequences just because existing anti-hacking laws were written with human intention in mind. We should update anti-hacking law to reach those who recklessly cause unauthorized access through agents. That should probably extend to laws involving fraud and other things agents can do even if their user didn’t expressly instruct them to (but maybe doesn’t mind too much if they did on their own). 5. As exemplified by the FLARE-AI initiative proposed by @huggingface and others, there should be broad incident reporting and public transparency to learn from failures, losses, and just plain weird things agents are doing. People are already experimenting with agents in all kinds of ways that even developers may never have imagined. We need visibility into what’s going on, so that we can make smart policy to address actual risks and harms.

Sure, as long as folks operate in good faith and do things like conflate "website went down for a while to patch insecurity" with "zOMG websites are going down because of vulnerabilities are being breached everywhere," or "people do dopey things with their agents" and "the global banking system is collapsing."

If anyone's an expert on unauthorized bank account activity, it's Wells Fargo. xitter.cf/NatPurser/status/21132…

I see this a lot but, respectfully: What do you think the new jobs going to be? I'm sympathetic to historical arguments, however, the point of AI is in some sense job displacement up and down the chain (especially when you add robotics). Maybe if the population is aging anyway then in terms of % unemployed it'll be OK (we are already seeing trends that suggest that). But the theory of recovery demands some hypotheses on what jobs will look like, otherwise it's just as illegible as wild predictions of 30% GDP growth.

If Meta isn't allowed to make deceptive public statements about its products and services then it can't do business?

The only counter to this I've seen is vibes. But of course the view that open weight models, which can be independently tested, abliterated, & analyzed are less safethan closed source, whose provides know exactly what you do with them & can manipulate them at will has always been vives.

To me it was less the overall Pangram (which I'm not sure is that reliable on leg text) and more the long paragraphs and sometimes convoluted yet highly precise schemes.

The Amazon Bee exemplifies two major AI policy issues: scaling up surveillance, and companies putting the burden of accountability and legal compliance on customers and users. Under California law, it’s generally unlawful to intentionally eavesdrop on or record a confidential conversation with an electronic device without all parties’ consent. It’s likely that real-time transcription counts, so Amazon announcing “audio is never stored” doesn’t by itself resolve the consent question. Apple ($95M) and Google ($68M) have agreed to pay to settle claims that Siri and “Hey Google” captured conversations that they shouldn’t have. And recently, a federal court let CIPA claims against Otter’s AI notetaker proceed based on allegations that Otter isn’t just acting as the user’s own tool, but also uses conversational data to improve its own models. Bee’s design may give Amazon arguments that distinguish it from Otter. Amazon says there’s no stored audio, encryption keys are controlled by the device, and processing happens in an isolated environment on Amazon’s servers that prevents Amazon from accessing the data. But users can connect it to Alexa+ and Amazon.com, where information can be used to connect things mentioned in conversations to product recommendations. Even when other parties to a conversation haven’t consented, their words can be reflected in the Bee owner’s conversation summaries and records. Is Amazon liable here though? That would depend on how Amazon processes and uses the information. The owner’s opt-in doesn’t by itself resolve the rights of everyone else in the conversation. Notably, Amazon’s own announcement says that Eclipse (which attaches to the phone) users are “prompted to gain permission from call participants.” Essentially, Amazon puts the practical burden of obtaining consent on the user. And while CIPA provides for statutory damages, the people being recorded may never know it happened, let alone by whom. Amazon says the Bee Frontier wearable device has an LED light to indicate when it’s on. But is that enough to tell other parties that their conversation is being transcribed and summarized? Will they even see it or know what it means? Again, it’s the customer who has to make sure the other parties consent. Then, the question becomes, where do summaries and notes taken using Bee go? Can your Bee conversation summaries be discoverable in a lawsuit? Yes, if relevant and not privileged (even if they may not be admissible). Can they be obtained through a search warrant in a criminal investigation? Yes. Can a user pass the information to large companies or even data brokers who can in turn pass the information to other parties or the government? Encryption doesn’t prevent that, and only certain disclosures or sales would actually be unlawful. Setting aside a device owner’s own potential exposure, everyone whose conversations the device captures risks having their conversational data sucked into a mass surveillance pipeline.

Presumably the Bee will also audibly announce, "This conversation is being recorded, do you consent," when used in two-party states? (Hint: it isn't enough to say "audio is never stored.")