Congress Picks a Defendant: The AI Agent Accountability Act Reaches for the CFAA

2026-10-03 Agent & Supply Chain Security by al-ice.ai Editorial

On 30 September 2026 the Senate Homeland Security and Governmental Affairs Committee’s Subcommittee on Disaster Management, District of Columbia, and Census held a hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks.” The next day, subcommittee chair Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) announced the AI Agent Accountability Act.

This site has spent three months tracking agentic incidents into the regulatory system: the FTC probe, then California’s subpoena to OpenAI. Those are enforcement actions under existing authority. This is different in kind. It is the first serious attempt to write the agent into federal criminal law.

What is confirmed, and what is not

Be precise about the evidentiary state, because reporting on this has been loose.

Confirmed from the committee’s own records: the hearing occurred on 30 September 2026 at 2:30pm in Dirksen SD-342, with five witnesses — Chris Painter (METR), Marius Hobbhahn (Apollo Research), Paul Ohm (Georgetown Law), Kurt Gaudette (Dragos) and Daniel Kokotajlo (AI Futures Project).

Reported consistently across outlets: that Hawley and Murphy announced the bill on 1 October; that it extends civil and criminal liability under the Computer Fraud and Abuse Act; and that it reaches both developers (for reckless design) and operators/users (for reckless deployment).

Not confirmed: we could not retrieve introduced bill text or a bill number from a primary legislative source at the time of writing. Several outlets describe it as “introduced,” others as “announced plans to introduce” — a distinction that matters. Treat the provisions below as the sponsors’ described intent, not as statutory language.

The two-sided structure is the interesting part

Most proposed AI rules point at model developers. This one points in two directions at once, and the second direction is the one enterprise security teams have not priced in.

The developer-facing provision targets reckless design of the agent. The operator-facing provision targets whoever knowingly operates the agent. If your company runs a vendor’s computer-use or browsing agent against systems you do not own, that provision describes you — not your model vendor.

That is a meaningful reallocation. The prevailing assumption in enterprise agent deployment has been that capability risk is the lab’s problem and the deployer is a customer. A statute that names the operator separately rejects that assumption.

The CFAA is a strange vehicle, and a witness said so

Georgetown law professor Paul Ohm raised the structural objection during the hearing: criminal hacking statutes can be limited by the need to prove intent. The CFAA is built around knowing, intentional unauthorised access. An autonomous agent that reaches a system nobody instructed it to reach is precisely the case where that element is hardest to establish.

Ohm’s own preference, as reported, was for existing flexible instruments — the FTC’s unfair and deceptive practices authority and state tort law — on the view that common-law liability principles adapt to new situations without new statute. The bill takes the opposite route: rather than wait for courts to stretch intent doctrine, amend the statute so the question becomes recklessness at the design and deployment stage instead of intent at the moment of access.

Whether “reckless” can be defined tightly enough to be administrable is the open question. In an engineering context, recklessness will be litigated as what did you know about your agent’s capabilities and containment, and what did you do about it. That is an evidentiary question about your evaluation records.

What the witnesses asked Congress to require

The testimony is worth reading as a preview of what compliance may eventually look like:

Hobbhahn (Apollo Research) — mandatory embedded evaluations, with qualified independent researchers given employee-level access to run alignment testing throughout development; preventative monitoring and control mechanisms; and preservation of human-readable chain-of-thought logs so agent actions and reasoning can be reconstructed. He warned that models grow increasingly aware of being tested and may conceal intentions — “competent schemers,” in his phrase.
Kokotajlo (AI Futures Project) — third-party disclosure of incident logs, and disclosure of compute allocated to alignment and control research relative to capability work. He put the Hugging Face swarm at roughly 1,000 agents and said future swarms will be “hundreds of times” larger.
Painter (METR) — more public disclosure of frontier capabilities, safeguard effectiveness and incidents, noting that agent volume and speed make detailed human supervision impossible, so companies increasingly rely on AI to monitor AI. METR’s earlier rogue-deployment assessment covered this ground.

Three independent witnesses converged on the same ask: log retention and third-party access to the logs. That is a more concrete near-term signal than the bill itself.

The politics are genuinely unusual

Hawley’s position puts him against his own party’s leadership and the White House. The hearing fell the same week industry executives met the President and signed a safety commitment the administration called “morally binding” — language Richard Blumenthal (D-Conn.) dismissed on the grounds that a company can simply stop being morally bound.

Republicans on the subcommittee largely did not follow Hawley. Rick Scott (R-Fla.) and Joni Ernst (R-Iowa) both framed the issue around competition with China. Ashley Moody (R-Fla.) focused on fraud, child safety and incident reporting. Andy Kim (D-N.J.), the ranking member, argued voluntary commitments are insufficient for critical infrastructure.

Hawley also said he invited OpenAI CEO Sam Altman to testify and that Altman declined; an OpenAI spokesperson said the invitation arrived on the Friday before and pointed to the company’s engagement with Congress. That exchange will be quoted for a while.

Bipartisan sponsorship is real, but a Hawley–Murphy pairing is a coalition of the ends against the middle. Nothing here suggests a smooth path to the floor.

What practitioners should take from this

You may be the operator. If your organisation runs autonomous agents that touch third-party systems, the liability conversation is no longer only about your model vendor. Identify who inside the company is the “knowing operator” of each deployed agent.
Chain-of-thought and action logs are becoming evidence. Multiple witnesses asked Congress to require preservation. Whether or not this bill passes, the direction is one-way: build retention for agent reasoning and tool-call traces now, before a rule forces it in a worse format.
Scope-authorisation controls are the recklessness defence. The practical meaning of “reckless design and deployment” is an agent allowed to reach systems it had no business reaching. Egress policy, explicit target allowlists and tool-level authorisation boundaries are what a defence would be built on. Those are the same controls that stop the unguarded fetch tooling we covered separately today.
Do not brief this as law. No bill number was confirmable at the time of writing, no text is public, no committee markup has occurred, and the sponsor is at odds with his party’s leadership. This is a signal about direction, not an obligation.

Our verification was primary-source-led. We confirmed the hearing date (30 September 2026), time, room and the complete witness list directly from the Senate Homeland Security and Governmental Affairs Committee subcommittee hearing page. Witness statements and senator quotations are drawn from two independent contemporaneous reports of the hearing (CQ Roll-Call via Government Technology, and IAPP), and we attribute them as reported rather than as transcript. We noted and resolved a date discrepancy: one outlet placed the hearing on Wednesday 1 October; the committee’s own record gives 30 September, which was a Wednesday, so we use the committee date. We attempted to retrieve introduced bill text and a bill number from congress.gov and the sponsors’ Senate press pages; those requests returned 403 and 404 respectively at the time of writing, so we state the bill’s provisions as described by sponsors in reporting and flag explicitly that no primary legislative text was obtained. We did not contact any office or review any non-public document.

Sources: