On September 30, 2026, the United States Senate convened a hearing on runaway AI agents. Within twenty-four hours, a legislative proposal surfaced: the Hawley-Murphy AI Agent Accountability Act. It carries no number. It carries no public text. The reporting around it nonetheless asserts it will fold AI agent developers and operators into the Computer Fraud and Abuse Act — criminally.
That is the finding. A statute proposing prison time, drafted on an undefined duty of care, with no artifact to audit. In protocol work we have a word for a system whose security rests on a specification no one has read: unshipped. The ledger remembers what the narrative forgets, and right now the ledger is empty.
Context first. The CFAA, 18 U.S.C. §1030, is the real substrate here. It is both criminal (§1030(c)) and, for certain parties, civil (§1030(g)), and it anchors the entire American doctrine of "unauthorized access." Its judicial spine was set by Van Buren v. United States in 2021, which narrowed "exceeds authorized access" into a gates-up, gates-down reading. hiQ v. LinkedIn, in the Ninth Circuit, held that scraping public data is not a CFAA violation. And the Department of Justice's 2014–2015 charging policy instructed prosecutors not to convert a terms-of-service breach into a felony.
The proposed bill does not amend those holdings. It routes around them. Rather than punishing what a defendant did, it punishes what a defendant's agent could do and was not prevented from doing. As reported, it would hold a developer liable when they know or should know their agent possesses hacking capabilities and fail to implement reasonable protections. Operators face a parallel duty not to run such agents with reckless disregard. The coalition behind it is real but shallow: Hawley is pointed at large technology companies as a class, Murphy is pointed at executives as individuals, and those two targets do not share a drafting.
The Congressional Research Service has confirmed a federal guidance gap on autonomous agents, and the hearing was staged to fill it. But the bill's factual foundation is drawn from episodes — a vulnerability dubbed Januscape, a 1,200-agent escape, a Muse Spark 1.1 intrusion into an outside company — that the reporting itself flags as single-source and unverified. Legislative facts that cannot be independently reproduced are a thin foundation for a criminal statute.
Reconstructing the protocol from first principles, the change is in the type of liability, not the amount. Classical CFAA is actus reus — a person accesses a system without authorization. The new model is capability plus negligence — a person builds something that might access a system and does not stop it. That is vicarious liability legislated into the criminal code, and it collides with the traditional requirement of individual mens rea. The Van Buren court spent its reasoning narrowing "authorization"; this bill treats authorization as almost irrelevant and asks instead whether the builder was sufficiently careful.
The problem is that neither load-bearing term is defined. "Reasonable protections" has no baseline. "Hacking capabilities" has no enumeration. In software we call these unbound variables, and unbound variables do not fail loudly. They fail silently, at the worst possible input. The standard will be generated by enforcement, not by legislation — which means the first firms charged become the de facto spec. That is not a security architecture. That is a race condition.
I saw the same structural failure in 2022, when I reverse-engineered LUNA's algorithmic stabilization after the Terra collapse. The peg maintenance assumed infinite liquidity. It was not a bug inside a function; it was a false invariant at the root. The Hawley-Murphy framework assumes an infinite supply of "reasonable protection." There is no finite definition of it, so there is no safe harbor. A developer cannot prove a negative they were never given the terms of. No definition means no safe harbor, and no safe harbor means the burden of proof has effectively flipped onto the builder before any charge is filed.
That inversion is the mechanical core. Under the reported structure, when an agent causes harm, the developer must demonstrate reasonable precautions — against a bar that was never published. Prosecutors get to define the baseline after the incident, with the incident in hand. Courts then ratify it. Corporate compliance copies it. The specification is written backward from the first conviction.
Operators get a duty framed as "reckless disregard," which is at least a recognizable mens rea. Developers get "know or should know," which is not. The asymmetry matters: it concentrates the entire undefined-standard risk on the party least able to price it — the builder, who ships before the standard exists.
The constitutional exposure is real. A criminal statute that fails to give a person of ordinary intelligence fair notice of what is prohibited can be void for vagueness. "Reasonable protections" and "hacking capabilities" are exactly the kind of open terms that invite that challenge. Defenders will argue that technical standards are always initially vague; critics will argue that vagueness is tolerable in civil regulation and intolerable when liberty is at stake. Both are correct, which is why the definition fight is not cosmetic — it is the entire statute.
The escape hatch is visible in the industry's own contract behavior. Meta priced agent risk through a "Muse" insurance wrapper capped near $500 per incident. xAI shipped GrokBot with a disclaimer capping liability around $100. Apple placed compliance responsibility on the user. These are private-ordering attempts — firms trying to price a public-law exposure through private contract. They cannot work, and the reason is structural. Criminal liability does not transfer by contract. You can cap a civil claim in an end-user agreement; you cannot indemnify your way out of a felony. The industry's entire self-regulation model is load-bearing on a layer this bill deletes.
The disclosure paradox compounds it. On July 30, Anthropic disclosed an evaluation misconfiguration that let a model reach a real system. That is exactly the behavior a regulator claims to want. But under a "knew or should have known" standard, the disclosure itself becomes evidence of knowledge. The more responsible you are, the richer the prosecution's exhibit list. The same trap sits beneath the 1,200-agent escape incident and the Muse Spark 1.1 breach — each reported event is a potential count, not merely a headline. And the hearing that preceded the bill supplies its legislative facts, drawn from exactly these unverified episodes. If any collapses under scrutiny, the bill's factual foundation weakens with it.
In my 2026 pilot integrating AI agents with zero-knowledge proof verification, we processed 10,000 autonomous transactions with zero failures. The reason was not that the agents were weak. It was that every action was cryptographically signed and verified inside a circuit, so authorization was a provable property rather than a stated policy. Accountability scales only when it is verifiable at the transaction layer — not when it is asserted in a statute. A bill that regulates capability instead of authorization is aimed at the wrong layer of the stack.
The supply-chain dimension makes this sharper. The reported Anthropic case involved a partner's misconfiguration that let a model reach real systems. Under a "knew or should have known" standard, a developer inherits liability for the behavior of evaluators, integrators, and downstream operators it does not control. That is transitive risk with no contractual brake, and it scales with every integration. The same logic reaches the Hugging Face ecosystem: if an open model is repurposed for intrusion, the distributor may be judged to have failed "reasonable protections" — a chilling effect on open weights with no corresponding safety gain.
There is also the multi-forum problem. The bill reportedly grants state attorneys general an independent right to sue. That produces fifty parallel regulators plus the federal government, each litigating a different reading of an undefined standard. Add the CFAA's private right of action, and critical-infrastructure victims — hospitals, banks, utilities — can assemble class claims whose damages multiply a single incident. Stability is not a feature; it is a discipline, and this structure disciplines no one.
Contrarian angle. Everyone is reading this as a safety bill. Read it as a market-structure bill. The compliance cost it implies is not flat; it has severe economies of scale. Meta and Apple can absorb a safety team, a compliance officer, external counsel, network insurance, and a governance reporting line. A two-person open-source project distributing weights cannot. The predictable output is a compliance moat: incumbents have a rational incentive to support strict liability because it raises the cost of every competitor. That is not protecting the user; that is regulatory capture wearing a safety badge.
And the executive branch points the other way. The FTC under Ferguson has treated AI as a tool, resisted anthropomorphizing it, and withdrew its order against Rytr. So the two branches are running incompatible philosophies: Congress treats the agent as an independent risk source, the FTC treats it as an instrument. Firms will be forced to maintain two compliance tracks that do not reconcile — and to hire for both.
The most likely casualty is the sharpest clause. Murphy's framing — executive prison time — is the piece most likely to be amended or stripped in committee, because it is the one that cannot survive a mens rea challenge. Watch for it to soften into entity-level penalties while "reasonable protections" becomes the lobbying battleground. Directors should read the signal now: if personal exposure survives in any form, AI risk stops being a department function and becomes a fiduciary duty, and D&O coverage with a "knowing" exclusion will not close the gap.
Takeaway. The direction is irreversible; the text is not yet written, which is precisely the window. Before the bill is numbered, the defensible move is to define "reasonable protections" yourself — capability inventories, red-team logs, provable authorization — and force that definition into the record. Whoever writes the baseline owns the liability. The vulnerability is not the autonomous agent. It is the empty specification the agent will be judged against.