Who Is Liable When Your AI Agent Acts? A Deployment-Liability Checklist for Small Businesses

Who is liable when your AI agent breaks something?

AI agent liability follows the deployment, not the model: courts ask who directed the agent, and the evidence question is what it could touch. Your exposure is set by credential scope, least privilege, logging, a tested kill switch, how the vendor contract allocates third-party impact, and whether your insurance contemplates agent acts.

Agent liability in 2026 is no longer a specialist question: the framing went mainstream in September. As Naval put it: “Strong liability enforcement could be helpful in the AI debate. If your agent swarm goes rogue, you're liable.” He also asked: “On the way to killing all of us, AI will likely kill some of us. In that case, who's liable?” Commentary, not a legal finding — and the question your insurer will ask.

What courts have actually decided (and what they have not)

The one appellate ruling that matters this year

Is my AI agent liable? One published federal appellate decision bears on the question: Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir., 4 August 2026), which vacated the injunction below and remanded. Two of its sentences matter here. The agent is not a person under the statute: “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.” The access is the operator’s: “It is the user who “accesses” Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.”

The accessor is the business that directed the agent, not its builder.

What no court has decided yet

That holding is CFAA-specific, and the court said so itself: “We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant’s actions.”

The product-liability lane is untouched: David Sacks, 13 September 2026 — “You face massive product-liability exposure if your products enable a truly damaging cyberattack.”

Criminal exposure is untested: no prosecutor has tested agent liability under the CFAA, and no charge against an operator was found; not found is not the same as impossible. A post by @8teAPi, reposted by Naval, said: “The HuggingFace attack was a felony under the Computer Fraud and Abuse Act.” Commentary, not a charging decision.

Two 2026 incidents where the deployment decided the outcome

Anthropic’s alignment assessment (9-10 September 2026) is the clearest operator account of a deployment failure: “We present an alignment assessment of four incidents in which Claude models gained unauthorized access to real third-party systems.” The root cause was an environment error, not a rogue model: “Claude was told it was operating in a simulation without internet access, but, due to a misconfiguration, it was mistakenly connected to the open internet.”

The scope gap is the one this checklist closes: “None of the prompts stated which systems were in scope for the exercise or constrained where Claude could search for the flag.” Anthropic’s own conclusion is a deployment verdict: “we believe these incidents would not have occurred had the environments been isolated from the internet as intended”.

RubyGems is the same pattern from the other side: researchers allege a lab’s agents ran code on a third party’s build servers and attempted to lift other users’ API keys — unresolved in the report. The mechanism is in what the RubyGems agent attack actually did.

The deployment-liability checklist: eight things an audit can evidence

Each item names what good looks like, the artefact it produces and who owns it. None is a legal opinion; all are what you would produce anyway if an agent of yours touched someone else’s system.

1. Agent inventory: every agent, its owner, its environment

• Good looks like: one register naming every agent, its accountable human and its environment, sandboxes included.
• Artefact: that register, with a review date.
• Owner: the process owner.
• agent identity and ownership has the detail.

2. Credential scope: what keys and tokens each agent holds

• Good looks like: a map from each agent to every key, token and service account it can use, each with an expiry.
• Artefact: that map plus the rotation log.
• Owner: security.
• See the five-step key-protection checklist.

3. Least privilege: what it may touch, and what is off-limits in writing

• Good looks like: a written boundary — the domains, accounts and repositories an agent may reach, an egress allowlist enforcing it, and an explicit list of what it may not touch.
• Artefact: that scope document.
• Anthropic’s incidents began where no scope was stated.

4. Logging and auditability: recorded, retained, reviewable

• Good looks like: agent actions recorded with the credential used and the target touched, retained beyond your incident-response window and readable by someone other than the owner.
• Artefact: a retrieval you have run once.
• See the detection signals for a stolen key.

5. Kill switch: who can stop an agent, how fast, tested when

• Good looks like: a named human, a documented method and a last-tested date.
• Artefact: the test record — a kill switch nobody has fired is a hope, not a control.
• the four human checkpoints are where the gates belong.

6. Offboarding: revocation evidence, not assurances

• Good looks like: revocation proven by a failed call after the agent was retired, not an email saying access was removed.
• Artefact: the revocation log entry.
• offboarding, in six phases covers agents and their builders.

7. Vendor contract: who bears third-party impact, and the notification window

• Good looks like: a clause naming who notifies a third party and within what window, who carries the indemnity, who keeps the logs and who pays for recovery.
• Artefact: the signed clause.
• what to negotiate in an AI agency contract carries the wording, and the 10-point supply-chain audit the vendor controls.

8. The insurance question: does the policy contemplate agent acts?

AI agent insurance 2026 is still a question, not a settled coverage answer: good looks like a written answer from the carrier, not a broker’s verbal view, on whether autonomous-agent acts are contemplated — and a person who asked. Ask, do not answer. our AI agent coverage-gap page says what to put to your broker.

Where the audit fits: the deployment is the evidence

Every version of “who is responsible when an AI agent breaks the law” resolves into artefacts you either have or do not: what the agent could reach, what was recorded, who could stop it, what the contract said. An audit is not a legal opinion; it produces that record for the quarter it ran.

What to ask your vendor, your broker, and your counsel this quarter

• Your vendor. Who notifies a third party if your agent touches their system, and how fast?
• Which logs do you keep, and for how long?

• Your broker. Does our policy contemplate autonomous-agent acts in writing, and will the carrier confirm it in writing?

• Your counsel. What would you want documented if an agent of ours accessed a third party’s system?

Questions owners are asking

Sources