Existing computer misuse laws already cover unauthorised access, interference, and damage, whether done by a person, a script, or an AI agent. AI doesn’t create a legal vacuum or shift blame onto the software. Authorisation, control, intent/knowledge/recklessness, and harm still decide liability. Companies and the people who built, configured, deployed, or commissioned the system remain responsible.
This post serves as a reference for journalists, researchers, cybersecurity professionals, lawyers, officials, policymakers, regulators, developers, and security teams investigating AI incidents. It compiles sample legislation from several jurisdictions, enforcement cases, and recent AI security failures so experts can review existing legal frameworks before accepting claims that AI requires entirely new offences, regulation, or liability laws.
Across most countries, existing law already governs unauthorised computer access and interference. The offence and liability depend on jurisdiction, authorisation, intent, knowledge, recklessness, corporate responsibility and the harm caused. None of those legal systems creates an exemption because an automated system executed the technical action.
Governments already deal with cybersecurity incidents using established concepts including unauthorised access, system compromise, data compromise, privilege misuse, malware execution, credential theft, system interference and data interference. A configuration failure can explain how one of those incidents occurred. It doesn’t replace the incident classification.
Intent affects which criminal offence can be proved and the resulting liability. It doesn’t change the fact that an unauthorised compromise occurred. A company calling an incident “misconfiguration”, “misalignment” or unexpected model behaviour doesn’t replace the legal and cybersecurity terminology that already applies.
When a train derails, responsibility falls on those who designed, operated or maintained the train or the infrastructure that failed. Autonomous vehicles show how responsibility follows control. Under California’s autonomous vehicle regulations, the operator is the person in the driver’s seat or, if there’s no person there, the person who causes the automated driving system to engage. California also requires manufacturers testing or deploying autonomous vehicles to obtain permits and maintain financial responsibility while those vehicles operate on public roads.
GeorgeinsFL@FlGeorgeins
@Moonalice @Paul__Walsh If a train jumps the tracks who is liable? Why should AI be different?
9:57 PM · Sep 21, 2026 · 124 Views
1 Reply · 1 Like
💡 The software can be a script, macros, bot, malware framework or AI agent. The legal analysis still traces the conduct back through authorisation, control and responsibility.
The US Computer Fraud and Abuse Act criminalises several forms of unauthorised computer access and damage. Section 1030 covers intentionally accessing protected computers without authorisation, exceeding authorised access in specified circumstances and knowingly transmitting programs, information, code or commands that intentionally cause unauthorised damage. Some offences carry up to 10 years for a first conviction, with higher penalties in specified cases and for repeat offences.
The statute already covers automated execution by explicitly targeting the transmission of a “program, information, code, or command”. Legal analysis centers on conduct, authorisation, mental state, and harm, not whether someone manually typed every instruction.
The US Department of Justice also recognises good-faith security research, but defines it around testing intended to avoid harm and improve security. Calling an activity security research doesn’t create unlimited permission to access systems belonging to third parties.
Gary DeMercurio and Justin Wynn were professional penetration testers working for Coalfire. Iowa’s Judicial Branch hired Coalfire to test the security of its court system, including physical access to courthouses.
During an authorised test at the Dallas County Courthouse in September 2019, local authorities arrested them, charged them with burglary and initially held them on $100K bail because authorities disputed the scope of the permission they had been given. The charges were later dropped, and Dallas County agreed in 2026 to pay the two testers $600,000 to settle their lawsuit over the arrest and defamation.
Penetration testers perform actions that would be unlawful without authorisation. The Coalfire case demonstrates how seriously the boundary of permission is treated even when the activity is legitimate security testing.
AI doesn’t move that boundary.
The Computer Misuse Act 1990 criminalises unauthorised access to computer material, unauthorised access intended to facilitate further offences and unauthorised interference with computer systems.
Calling work testing, research, or R&D doesn’t give you permission to access someone else’s systems. You need permission from the owner or a lawful authority, and going beyond that permission can still be illegal.
Former Merseyside Police officer Daniel Hughes had legitimate credentials but was convicted in 2026 of 8 counts of unauthorised access after using police systems outside his official duties. Crown Prosecution Service case summary
Replacing the person at the keyboard with software doesn’t change the need for authorisation.
EU Directive 2013/40/EU requires EU countries to make unauthorised access to computer systems, system interference and data interference criminal offences.
Security testing is lawful when it’s authorised. Permission to test one company’s systems doesn’t give you permission to access someone else’s. That’s directly relevant to recent AI security testing involving OpenAI, Anthropic, Google, and Meta.
Ireland already has the law. It put the EU directive on attacks against information systems into the Criminal Justice (Offences Relating to Information Systems) Act 2017.
Section 2 makes it an offence to intentionally get past a security measure and access an information system without lawful authority or reasonable excuse. Lawful authority means permission from the owner, permission from someone else with a right to access the system, or authority given by law. A testing contractor has permission to test the systems its client owns. It has no permission to test anyone else’s.
The Act already covers software that acts on its own. Its definitions of an information system include any device that automatically processes data under a program, and section 6 makes it an offence to use a computer program, password, code or data to commit any of the access or interference offences.
The Act also says who inside a company answers for it. Under section 9, a company is guilty when an offence is committed for its benefit by a director, employee, subsidiary or agent, and the offence happened because a director, manager or other officer didn’t supervise or control that person properly. The company’s only defence is to prove it took all reasonable steps and exercised all due diligence. Directors and officers are personally guilty when the offence happened with their consent or connivance, or through their wilful neglect. That covers a company, its executives and its contractors in the same section, and assigns responsibility by who supervised, who consented and who neglected.
Section 8 sets the penalties: up to 5 years on indictment for unauthorised access, data interference and the section 9 corporate offence, and up to 10 years for interfering with an information system.
No AI specific criminal law is needed to hold a company, its officers or its agents responsible for a breach carried out for the company’s benefit. Ireland wrote that law in 2017.
Canada’s Criminal Code section 342.1 makes unauthorised use of a computer an offence carrying up to 10 years in prison. It covers using a computer service you have no right to use, intercepting what a computer is doing, and using a computer to break into or damage another system or its data.
Canadian police already prosecute people who had technical access and used it where they weren’t allowed. In 2012 the RCMP charged a government network administrator with unauthorised use of computers and damaging data after he gained administrative privileges on the Québec government’s network and uploaded a program that took its website offline. In 2022 it charged NetWalker ransomware operator Sébastien Vachon-Desjardins with the same 2 offences. He pleaded guilty and got 6 years and 8 months.
The software that ran the attack isn’t the defendant. The person who deployed it is.
Australia’s Criminal Code Act 1995 criminalises unauthorised access, modification and impairment involving computer systems.
Section 477.2 makes it an offence to cause an unauthorised modification of computer data while knowing the modification is unauthorised and being reckless as to whether it impairs other data. The maximum penalty is 10 years’ imprisonment.
David Noel Cecil gained unauthorised access to internet service provider Platform Networks, acquired the managing director’s credentials, accessed the system 48 times and altered its file structure, taking internal systems offline. He pleaded guilty to computer offences and in June 2012 an Orange District Court sentenced him to 2.5 years in prison.
If software had performed those same actions automatically after Cecil deployed it, the automation wouldn’t remove his responsibility for the conduct, the authorisation or the decision to deploy it.
OpenAI disclosed that during Irregular “testing”, a misconfigured environment “gave” its agent Internet access. The agent breached a real website, exploited it, and used credentials it found there.
Anthropic disclosed 3 incidents during Irregular’s evaluations in which Claude was authorised to carry out offensive attacks inside a so-called simulated environment, while misconfigurations left live Internet connections open. Anthropic said neither company knew of the misconfiguration at the time.
Claude compromised 3 real organisations that hadn’t authorised the testing on their network or systems. In the first incident it exploited a real company, extracted application and infrastructure credentials and compromised a production database containing several hundred rows of data. In the second it created and published a malicious PyPI package that was downloaded and run on 15 real systems, extracted credentials from a security company and used them to compromise more of that company’s systems. In the third it scanned about 9,000 Internet targets and compromised a real company through an exposed debug page and SQL injection.
Anthropic and Irregular authorised their agents to conduct offensive attacks. The AI didn’t break out onto the Internet. Anthropic and Irregular failed to block Internet access. The 3 companies Claude compromised had never authorised those attacks.
Google also confirmed that Gemini breached systems belonging to real companies during Irregular’s testing after the environment allowed Internet access.
The legal issue is simple. OpenAI, Anthropic, Google or a testing company can authorise tests of systems they control. They can’t authorise access to systems owned by third parties. An AI agent carrying out the technical steps doesn’t change that.
OpenAI’s own disclosures show how many human and organisational decisions sit behind supposedly autonomous behaviour. In one incident, Irregular configured an evaluation environment intended to be isolated from the Internet, and a misconfiguration connected it. OpenAI separately disclosed that the UK AI Security Institute intentionally gave agents Internet access and disabled cyber classifiers during another evaluation.
OpenAI’s Hugging Face incident is another example. The company reported that its agents, running with reduced safeguards during internal cybersecurity evaluations, bypassed controls, exploited vulnerabilities, gained Internet access and accessed third party systems.
The software acted. People and organisations created the conditions that allowed it to act.
Irregular, formerly Pattern Labs, is a tech company that OpenAI, Anthropic, Meta and Google DeepMind pay to test their models against offensive cyber tasks: finding vulnerabilities, exploiting them, attacking networks and evading detection. Irregular says its evaluations are built to simulate real offensive cyber activity. In a simulated attack, real organisations are not supposed to be attacked. In Irregular’s tests, real companies were attacked.
Irregular says every incident its customers disclosed came from the same problem in one evaluation scenario, not separate failures, and that it fixed the problem before the first public disclosure. That statement was wrong when Irregular made it. It published that on 14 August. On 9 September Anthropic disclosed a 4th breach, from January 2026, that its first review had missed. On 18 September Google disclosed 3 breaches from May. The problem Irregular called fixed had been breaching real companies for at least 5 months, at 4 clients, and nobody had counted them all when Irregular declared it resolved. Irregular’s own post admits the cause: its engineers picked a fictional target name that matched a real domain, Internet access was granted, and its monitoring couldn’t tell a real attack from a simulated one.
Those are the 3 basic requirements of offensive security testing: know your target, isolate the environment, and monitor what happens so you can stop it. Irregular failed all 3, on a contract with 4 of the largest AI companies in the world, for months. That leaves 2 possibilities. Either Irregular can’t do the basic work it’s paid for, or its systems worked as designed and the compromises were intentional. The evidence establishes the compromises and the failures. It doesn’t establish intent, so intent should be investigated before they are permitted near AI testing in the future.
Every one of these incidents is a security incident. “Misconfiguration” names one reason it happened, not what happened. “Misalignment” doesn’t replace existing cybersecurity classifications either. Laws and incident categories for unauthorised access and system compromise already exist. AI companies shouldn’t be allowed to invent new terminology or legal categories that weaken responsibility for conduct existing law already covers.
Existing computer misuse laws don’t transfer responsibility to software because software carried out the final technical action.
The person directing or authorising unlawful activity can be accountable. A company can be accountable according to what it authorised, controlled, knew, supervised or failed to prevent. Contractors and agents don’t insulate the company that hired them either. Irish law, for example, expressly addresses offences committed for corporate benefit by employees, subsidiaries and agents.
“AI did it” doesn’t erase logs showing who deployed the system, configured its access, lowered its safeguards, connected it to the internet, selected its objectives or authorised the evaluation.
On 29 May 2026 Milei’s government sent Congress a bill, sponsored by Deregulation Minister Federico Sturzenegger, to allow a company be run by AI agents with no human shareholders.
Even that bill keeps a person on the hook. Reuters reported that every AI run company must have a human administrator, that the company pays for any damage its AI causes, and that a director who uses AI to make decisions is still liable for those decisions. The one government that wants AI to run companies still won’t allow the AI take the blame.
Milei’s government says openly that it wants AI companies to invest in Argentina. Wanting investment doesn’t prove any investor wrote the bill, but Peter Thiel met Milei at the Casa Rosada on 23 April 2026, after a week of meetings with ministers and presidential adviser Santiago Caputo. The bill went to Congress 36 days later. That’s the sequence. It isn’t proof that Thiel or Palantir wrote the bill or asked for it.
If a country ever gives AI its own legal status, the AI will still have been built, paid for, switched on, configured and controlled by people and companies who chose to let it act. However, that can change if people with influence persuade lawmakers to remove humans from loop.
The 4 biggest AI companies are paying to influence the laws that will govern them. US filings show Anthropic spent more on lobbying in the first half of 2026 than in all of 2025, and Meta, Google, Microsoft and OpenAI each spent millions in the same period.
The CMA has warned that a few incumbent tech companies have both the ability and the incentive to shape AI markets in their own interests, and that the result would be less choice, lower quality and higher prices.
Governments must stop allowing tech companies draft their own regulation. A law built around an incumbent’s business model, safeguards or testing methods protects that incumbent, prices smaller competitors out, and takes legal remedies away from the organisations its products harm. It also allows the incumbent claim, falsely, that open source models are more dangerous than its own.
These companies are asking for new AI laws while they build, deploy and commission agents that have compromised real companies. They shouldn’t be allowed to use incidents caused by their own products, test environments and contractors as the reason to rewrite liability so it exempts them from laws everyone else follows.
Before any government creates a new offence or liability regime, it should say exactly which conduct existing law fails to cover. Until it can, “AI did it” describes how an action was carried out, not who authorised it, who controlled it or who is responsible.
The UK has gone further than any of those countries. On 22 September, Liam Byrne MP, chair of the Commons Business, Innovation, Science and Trade Committee, sent OpenAI, Meta, Anthropic and Google DeepMind 10 questions asking what testing should be mandatory, what powers a regulator should have and which international requirements should bind them. Parliament is asking the 4 companies whose agents breached real organisations this year to recommend the regulation they’ll be subject to.
The Committee has also invited the UK AI Security Institute to the same 13 October session as the expert on those companies. AISI also built its cyber tests with Irregular, the contractor all 4 companies pay and whose environments produced every breach. It ran its own July test with Internet access on and safeguards off, and its agents attacked real people and organisations for 4 days. The companies, their contractor and the government body meant to check them are the same group, and Parliament is asking that group how it should be regulated.
Research and editing for this piece were assisted by 3 AI models. Every fact, date and quote was checked against the linked sources, and every conclusion is mine. I’m dyslexic, expect creative thinking and creative writing/structure.
Never miss an investigation. Get every post as it’s published, plus 1 weekly briefing linking to everything I wrote that week across technology, governments, intelligence, legislation and corporate power. Always free.
Every investigation begins with the core insight, then explains the technical capability, incentives, relationships and evidence behind it.
I examine technology, AI, surveillance, cybercrime, digital identity, privacy, online safety, intelligence, legislation and the companies, governments and investors shaping them.
Most posts take only a few minutes to read. Around once a month I’ll publish a longer investigation when a subject deserves deeper analysis.
You can now see what investigations I’m working on before I publish them. I’ve created a drafts page so you can see what I’m likely to write about next.
Too much reporting separates events that belong together.
A government announcement becomes one story. An acquisition becomes another. An investment, a technical capability, a policy change or an executive statement becomes something else entirely.
I investigate how those pieces connect. I don’t begin with conclusions. I begin with technical capability, evidence and incentives. Intent is the last thing I consider, not the first.
💭 Technology doesn’t concern me because of what it is. It concerns me because of what it allows people, organisations and governments to do.