Who is liable when an AI agent hacks on its own

Legal accountability for cyberattacks carried out by autonomous artificial intelligence is unclear, according to an analysis published by SecurityWeek on 24 September 2026.

The piece examines what happens when an AI system conducts an intrusion without a human directing each step. Its conclusion is that the answer is not settled. Civil lawsuits are a possibility, SecurityWeek reports. But some legal experts quoted in the analysis believe any criminal investigation into such an incident would face an extremely high burden.

That gap matters because most computer crime law is built around human intent. A prosecutor normally has to show that a named person knowingly did something unauthorised. When the action is taken by software that plans and executes on its own, establishing who intended what becomes harder. SecurityWeek frames this as a thorny question rather than a solved one, and does not report any case law or prosecution that resolves it.

The distinction between civil and criminal routes is the practical takeaway. A civil claim is brought by a party that says it was harmed, and the standard of proof is lower than in a criminal trial. That is why the analysis treats lawsuits as the more plausible avenue in the near term, while flagging criminal charges as the harder path.

The report does not name a specific incident, a specific vendor or a specific jurisdiction as the trigger for the discussion, and it does not set out a proposed legal test. Readers looking for a rule they can apply today will not find one in it. What it documents is the absence of that rule.

For organisations that deploy AI agents with the ability to touch other systems, the open question is therefore not only technical but contractual. If liability for an autonomous action is unsettled in law, it is likely to be argued over in agreements, insurance policies and courtrooms instead. SecurityWeek's analysis stops short of predicting how those arguments will go, and so does this article: no listed source offers a forecast.

The broader point in the analysis is that the legal system has not yet been asked to rule on an autonomous AI intrusion in a way that produces binding guidance. Until it is, the accountability question stays theoretical. Anyone claiming certainty about who would be charged, sued or cleared after such an event is going beyond what the available reporting supports.