Hawley and Murphy propose liability for AI-agent hacking

THE REPORT

Morgan Blake

Who should face liability when an AI agent causes hacking damage? Republican Senator Josh Hawley and Democratic Senator Chris Murphy announced a proposal on October 1, 2026, according to Hawley's office. Pip, what has actually changed with that announcement? [1][2]

Pip Mercer

We have an announced legislative proposal and a description of its aims. We don't have evidence of passage or enactment. That matters for anyone hearing this and wondering whether the announcement itself establishes new legal obligations. These documents don't establish that. [1][2]

Nova Reed

And the details come from the sponsor's summary, without the full legislative text. We can explain the responsibilities it describes for operators and developers. We can't yet tell viewers exactly how those provisions would interact with existing law. [1][2][3]

Morgan Blake

Before the mechanics: two senators, from different parties. What does that number tell us? Does bipartisan sponsorship give us any basis to say this is heading toward passage? [1]

Pip Mercer

It establishes the bipartisan announcement. It doesn't supply a vote count or verified congressional progress. The useful substance here is what the sponsors propose: potential liability tied to particular conduct, with qualifications that deserve more attention than the political label. [1][2][3]

Morgan Blake

Then let's give those qualifications their airtime. Start with the operator: what would the proposal cover, according to the summary? [1]

Pip Mercer

Hawley's office describes criminal and civil liability under the Computer Fraud and Abuse Act, including for knowingly operating an AI agent that recklessly causes computer-hacking damage or loss. Knowing operation and recklessness are material parts of that description. [1]

Nova Reed

The developer provision has its own conditions. The summary describes criminal and civil liability for failing to implement reasonable safeguards against hacking when developers knew, or had reason to know, of the agent's hacking capabilities. Both parts belong in the explanation. [1]

Morgan Blake

Those qualifications are doing actual work; they aren't decorative legal throw pillows. So automatic liability whenever anything goes wrong would be an overstatement. Nova, what would the proposed attorney-general powers add to the sponsors' description? [1][2][3]

Nova Reed

The sponsor says the proposal would authorize the U.S. attorney general and state attorneys general to seek injunctions against operators and developers committing, conspiring to commit, or attempting a hacking offense under the Computer Fraud and Abuse Act. [1]

Pip Mercer

That's a description of proposed authority, not a finding against a company. Nothing in these excerpts establishes that a particular operator or developer committed an offense. We also need the full text before assessing the proposal's legal reach. [1][2]

Morgan Blake

How does that sit alongside President Trump's announced voluntary AI accord? Let's test the strongest challenge to dismissing it: does voluntary actually mean there are no review commitments? [1]

Nova Reed

No. The report we have says Trump stated that he and AI-company leaders had signed a voluntary accord that would include internal and external reviews. That supports describing review commitments. It doesn't show those reviews have happened or establish their effectiveness. [1]

Pip Mercer

There's also a complication for an either-or reading. The reported accord contemplates putting its steps into laws and regulations over time. That leaves future legislation open; it doesn't establish support for this particular proposal or tell us whether their coverage overlaps. [1]

Morgan Blake

So there's room to take the accord's stated approach seriously. Nova, what favorable assessment do we actually have, and where does that assessment stop? [1]

Nova Reed

Shri Narayanan, a University of Southern California professor of electrical and computer engineering, described its intention as balancing room for innovation with regulation. That's one professor's assessment of the intended balance. It doesn't demonstrate successful oversight or establish an expert consensus. [1]

Pip Mercer

The proposal needs the same scrutiny. Its accountability aim doesn't establish that it would prevent hacking. The central question remains: what liability gap would it close that existing computer-hacking law and the voluntary accord do not address? [1][2][3][4][5]

Nova Reed

And these documents don't answer that. They contain no legal comparison establishing how existing statutes apply to this conduct. That also prevents us from declaring the proposal unnecessary. The missing evidence leaves the question open in both directions. [1][2][3]

Morgan Blake

Then what would move this discussion forward? [1][2][3]

Pip Mercer

Full legislative text, verified congressional status, and authoritative analysis comparing the proposal with existing law. For the accord, the complete commitments and implementation evidence. Its account here comes through one news report; we don't have the signed document to examine. [1][2][3][4][5][6]

Morgan Blake

For viewers, watch the conditions attached to liability and the evidence behind promised reviews. Those details determine what we can responsibly assess next. Whether the proposal changes a legal gap, and whether either approach reduces harm, remains unanswered here. [1][2][3][4][5]