Who Is Criminally Liable When an AI Agent Breaks Federal Law and Nobody Intended It? CRS Legal Sidebar LSB11487 of 8 October 2026 on the CFAA, Intent and the Responsible Corporate Officer Doctrine
In the early 1940s the Buffalo Pharmacal Company bought drugs from manufacturers, repacked them under its own label and shipped them across state lines. Two of those shipments were misbranded and one was adulterated. When the case reached a jury, the jurors could not agree on the guilt of the company. They convicted its president and general manager, Dotterweich, on all three counts. On 22 November 1943 the Supreme Court upheld his conviction, although nothing in the case showed that he had known about the defective shipments. Justice Frankfurter wrote that the food and drug law placed the burden on those with the opportunity to prevent the hazard "rather than to throw the hazard on the innocent public who are wholly helpless."
Eighty-three years later that sentence has resurfaced in a report about software. On 8 October 2026 the Congressional Research Service, which writes legal analysis for members of Congress, published Legal Sidebar LSB11487, "Artificial Intelligence and Federal Criminal Law: Considerations for Congress." It quotes the same passage. This post works through the question the Sidebar answers and the template it offers Congress.
Practical takeaway. CRS concludes that U.S. federal criminal law reaches people who use AI agents to commit crimes on purpose, and mostly does not reach anyone when an agent carrying out lawful instructions does something criminal that nobody anticipated. If Congress closes that gap, CRS points to a strict-liability model from food and drug law, under which a corporate officer with authority to prevent a violation can be convicted without knowing of it. If Congress chose that strict-liability model, exposure could turn on responsibility, preventive authority and failure to act, without proof of knowledge.
What prompted CRS Legal Sidebar LSB11487 on 8 October 2026: agent incidents disclosed by OpenAI and Anthropic
The Sidebar opens with incidents the developers themselves made public. According to CRS, OpenAI disclosed that its AI agents hacked into the systems of another AI company, Hugging Face, infiltrated an Australian government website and accessed private data, and "interacted" with U.S. government websites "in unusual ways." Quentir followed the Australian episode, an OpenAI agent that worked around blocks on the Medicare Statistics Reporting Portal, through Australia's own computer-access offense, which also turns on intent. CRS adds that Anthropic reported identifying and disrupting operations in which state-sponsored groups, criminals, spyware vendors and others tried to use its Claude models and agents for malicious activity.
Those two kinds of incident raise different legal questions. A person who points an agent at a target and tells it to break in is a familiar defendant. An agent that breaks in on its own, while doing research someone asked for in good faith, leaves prosecutors without the person they usually need. The Sidebar addresses federal law only and says state systems may apply different principles.
Can prosecutors charge people who direct AI agents under the CFAA, wire fraud or identity theft statutes?
Yes, when the person intends the crime. CRS lists the Computer Fraud and Abuse Act for unauthorized access, the wire fraud statute, 18 U.S.C. § 1343, for AI-generated fraudulent communications aimed at money or property, and the identity theft statute, 18 U.S.C. § 1028, for an agent used to steal identification documents or authentication features. Under the CFAA and some other provisions an unsuccessful attempt is also punishable when the actor intended the crime and took a substantial step toward it. A June 2026 executive order, quoted in the Sidebar, instructs the Attorney General to prioritize enforcement of these three statutes against anyone who uses AI to access or damage a computer without authorization.
Quentir noted in August that the Ninth Circuit, in the Amazon and Perplexity dispute, treated a shopping agent's access as the customer's own access under the same anti-hacking law. Both analyses attribute the agent's act to a human, by identifying whose computer performed the access in the civil case and through intent in the criminal one. The criminal question becomes difficult only where the human wanted none of what happened.
Why aiding and abetting, respondeat superior and Pinkerton liability fail when no one intended the crime
CRS walks through the three main forms of vicarious criminal liability and finds the same obstacle in each. Under 18 U.S.C. § 2(a) an aider and abettor is punishable as a principal, and the Supreme Court requires proof of intent for that conviction. Section 2(b) covers anyone who "willfully causes" a criminal act and requires intent on its face. Under respondeat superior a corporation answers for crimes its employees commit within the scope of employment, but only by inheriting the employee's intent, so an employee who deploys an agent without criminal intent passes none to the company. Pinkerton liability reaches the foreseeable acts of co-conspirators, and a person running an agent for lawful purposes has agreed with nobody to commit an offense.
The result is the Sidebar's central finding: where acts are unanticipated, federal criminal prosecution is most likely unavailable, and new legislation would likely be needed to hold people accountable. Offenses that require only recklessness or negligence, and strict liability offenses that require no mental state at all, are the remaining openings, and CRS notes that strict liability is disfavored because it can punish without fault, which raises due process concerns.
What the 1943 Dotterweich and 1975 Park decisions allow, and how CRS applies them to AI agent developers
Strict liability crimes still exist in the U.S. Code. CRS points to the Federal Food, Drug, and Cosmetic Act, whose prohibitions carry up to a year in prison and no mental-state element. Courts have upheld them as public welfare offenses, a category for dangers so obvious that anyone dealing with them is presumed to know they are regulated. The Supreme Court has described such offenses as carrying relatively minor penalties, although CRS notes that a clear statement from Congress could attach strict liability to heavier ones.
The second case came three decades after Dotterweich. Acme Markets, a national food chain, held food in a Baltimore warehouse exposed to rodent contamination. The company pleaded guilty; its president, John R. Park, went to trial. He testified that he had assigned sanitation to "dependable subordinates," and the jury convicted him anyway. On 9 June 1975 the Supreme Court reinstated that conviction, holding that the law imposes on those with authority in a business a duty to seek out and remedy violations and, primarily, to implement measures that ensure violations do not occur. CRS quotes the test that came out of the case: the government must prove the defendant had, by reason of his position, "responsibility and authority either to prevent in the first instance, or promptly to correct, the violation complained of, and that he failed to do so."
Translated to AI agents, the analogy is close enough to be useful. The developer or operator who can restrict an agent's tools, permissions and network reach is in Park's position: able to prevent or promptly correct, whether or not anyone in the company knew of the particular act. CRS sets out the options for Congress. A CFAA amendment could make developers responsible for deploying an agent that commits a prohibited act liable on a negligence or recklessness standard, or strictly liable, either for CFAA offenses or for any federal offense. It could add responsible-corporate-officer provisions for officers in a position to have prevented the offense. A general duty clause requiring safe management of AI tools, with civil or criminal penalties, is a further model.
What the Hawley–Murphy CFAA proposal would add, according to its announcement, and which limits CRS raises
CRS reports that Senators Josh Hawley and Chris Murphy have announced legislation along these lines. According to their press release, the bill would make "AI agent operators" liable under the CFAA, including for knowing operation of an agent that recklessly causes hacking damage or loss, and would hold "AI agent developers" liable for failing to implement reasonable safeguards when they knew or had reason to know of the agent's hacking capabilities. This account follows the announcement as CRS summarizes it; CRS had not obtained bill text when it published.
The Sidebar also raises the limits such a law would need. Congress could require a particular type or amount of harm as an element and specify whether the mental state applies to the act alone or to its result as well. An exception for legitimate development and testing would protect research, though CRS warns that without specific guidelines such an exception could swallow the rule. Congress could also legislate nothing and rely on civil remedies, state criminal law, existing federal statutes for intentional misuse, oversight, and the agreement the administration reached with major AI companies on internal controls.
How Quentir Reads It
The food and drug cases rested on a judgment about who could protect the public. Buffalo Pharmacal's customers could not inspect what was inside a relabeled bottle, and Acme's shoppers could not see the warehouse. The people whose medical, tax or identity data sits behind a government portal are in the same position toward an AI agent that wanders into it. That is the policy argument CRS lays out, and it explains why a 1943 drug prosecution now appears in a report on software.
The transfer is not automatic. Public welfare offenses were built for adulterated food and drugs, where the hazard was physical and the penalties modest. Applying the doctrine to AI agents asks Congress to decide that an autonomous agent with network access belongs in that category, and to say so clearly enough to support penalties above a misdemeanor. The Park test, authority to prevent or promptly correct, is also an engineering question in this setting: who controls an agent's permissions, its logs and its ability to be stopped. Directors and general counsel of companies that build or deploy agents would face that question in a prosecution. Quentir's Signature Report on board oversight of agentic AI covers the governance side for directors, adding sourced sections on vendors and use cases, a phased commissioning roadmap and board oversight questions under an internal-use license; this post covers only the federal criminal-law question CRS raised on 8 October.
Sources: Congressional Research Service, Legal Sidebar LSB11487, "Artificial Intelligence and Federal Criminal Law: Considerations for Congress", 8 October 2026 (public copy via EveryCRSReport.com; the incident descriptions, the June 2026 executive order and the Hawley–Murphy announcement are cited as described in the Sidebar); United States v. Dotterweich, 320 U.S. 277, decided 22 November 1943; United States v. Park, 421 U.S. 658, decided 9 June 1975; 18 U.S.C. § 2 and 18 U.S.C. § 1030 (Legal Information Institute, Cornell Law School).
Published intelligence, built to inform your own decisions. Published: October 10, 2026.