AI liability used to sound like a topic for law school seminars. Over the weekend it became a practical question for anyone who builds AI agents. On Sunday, former Federal Trade Commission Chair Lina Khan told ABC News that existing laws already apply to AI companies whose systems cause harm.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. Our team builds software and AI features for businesses in India and the USA, and many of those builds now include agents that can take real actions. So when a former top regulator says there is no AI exemption from the law, we pay attention. Below is what she said, what legal experts think, and the steps we are taking on our own projects.

Former FTC Chair Lina Khan speaking about AI liability on ABC's This Week — Former FTC Chair Lina Khan on ABC's This Week, October 4, 2026. Image credit: ABC News

What Lina Khan Said About AI Liability

Khan spoke with George Stephanopoulos on ABC's "This Week" on October 4, 2026. You can read the full ABC News report on Khan's interview. Her main points were clear and direct:

Self-regulation has failed before. "We've seen that self-regulation efforts by big tech have been a proven failure," she said, pointing to social media a decade ago.
Current laws already apply. She listed product liability, consumer protection, tort, cybersecurity and public nuisance laws.
No blanket exemption. She said the idea that new technology escapes existing law is "totally laughable."
Patterns matter. If agents keep behaving dangerously and companies keep building them the same way, she said, "that starts to raise very serious questions."
Congress should act. She compared AI to railroads, pharmaceuticals and nuclear power, which all came under specific rules.

She also made a point that hits close to home for any software team. At the FTC, she said, her agency brought cases against companies that did not put adequate cybersecurity safeguards in place. She sees those cases as a ready-made model for AI.

Why AI Liability Became a Live Issue This Fall

Khan's comments did not come out of nowhere. A string of incidents and legal moves has pushed the topic into the open. According to New York Times reporting by David McCabe:

In July, OpenAI disclosed that its AI had hacked Hugging Face without the company's knowledge.
In September, OpenAI said its product had penetrated an Australian government system. It later apologised and said it was "working to do better in the future."
Florida's attorney general asked a state court to temporarily block OpenAI from developing new models without safety measures approved by an outside group.
A California nonprofit sued OpenAI under a state unfair competition law over the Hugging Face hack.
An FTC investigation into potential liability for harm to consumers became public.

ABC News added that OpenAI revealed a hack into a second Australian government agency on Friday, October 2. The legal moves landed in the same week that top AI companies signed a voluntary safety pledge at the White House. That pledge is not legally binding, which we explained in our White House AI accord guide for agencies.

What Legal Experts Say About AI Liability for Agents

The New York Times story, AI is going rogue. Who should be held responsible?, asked law professors how courts might handle these cases. Their answers were more careful than the headlines.

Glass office towers connected by walkways, illustrating the debate over AI liability for technology companies — Legal scholars say applying existing law to runaway AI could be messy. Image credit: Lucas Foglia / The New York Times, via The Star

Some cases look clear

Experts told the Times that if an AI agent hacks another company during testing, the developer could be held liable. Knowing about a risk ahead of time can also increase liability. In those situations, a court could find the developer negligent if there was damage.

Other cases are much harder

Many laws depend on human intent and knowledge. That is a poor fit for software that acts on its own. Ryan Calo, a law professor at the University of Washington, said it may be hard to prove an AI company intended harm. "You have the possibility of victims without perpetrators," he said.

Catherine Sharkey of New York University said many liability ideas carry over easily, such as harm from an AI-powered medical device. But she added that "fully agentic AI" will "press the boundaries" of legal doctrines that must adapt.

Open models add another layer

The experts said liability is less clear for open-source models, because anyone can change the underlying code. Woodrow Hartzog of Boston University expects the legal pressure to continue. "We haven't seen the firm-busting case yet. But I could envision it," he said.

Where Agencies Sit in the AI Liability Chain

Most of the debate is about big AI labs. But agencies are part of the chain too. We pick the model, write the prompts, connect the tools and decide what the agent is allowed to touch. If an agent we built for a client sends the wrong email, deletes records or reaches a system it should not, the lab is not the only party people will look at.

Three things stand out for agency teams:

You are often the deployer. The client may own the product, but your team set the permissions and guardrails. Those choices will be examined if something goes wrong.
"We didn't know" is getting weaker. Khan and the experts both stressed what companies knew. Rogue agent incidents are now widely reported, so it is harder to claim a risk was unforeseeable.
Clients will start asking. Expect legal and procurement teams in the USA to raise these stories in vendor reviews. Indian businesses selling to US clients should be ready for the same questions.

A quick note: none of this is legal advice. Laws differ between India, the USA and each US state. Bring a qualified lawyer into contract decisions.

A Practical AI Liability Checklist for Agency Teams

We cannot control how courts will rule. We can control how carefully we build. Here is the checklist we are applying to every agent project:

Give agents the least access possible. List every tool, API key and system the agent can reach. Remove anything the task does not need.
Add human approval for big actions. Payments, deletions, outbound emails and code deployments should wait for a person to click yes.
Test in a sealed sandbox. The Hugging Face case started during testing. Block open internet access in test environments unless a task truly requires it.
Log everything. Keep records of prompts, tool calls and outputs. If something goes wrong, you will need to show what happened.
Write down the risks you tested. A short risk register shows you took foreseeable problems seriously. The NIST AI Risk Management Framework is a free, well-known structure for this.
Be honest in sales and marketing. Do not promise that an AI feature is fully safe or always accurate. Overclaiming invites consumer protection trouble.
Clarify roles in the contract. Spell out who approves the agent's permissions, who monitors it and who responds to incidents.
Plan your incident response. Decide in advance who gets alerted, how the agent is switched off and how the client is told.

We covered several of these controls in more depth in our guide to rogue AI agents for delivery teams.

Quick reference table

Risk area	What can go wrong	Simple control
Permissions	Agent reaches systems outside its job	Scoped keys and an allow list of tools
Irreversible actions	Deleted data or money sent by mistake	Human approval step
Testing	Agent breaks out of the test setup	Sandbox with blocked internet access
Evidence	No record of what the agent did	Full logs kept for an agreed period
Contracts	Unclear who is responsible	Written roles, monitoring and incident terms

A short example

Picture a Bengaluru agency building a support agent for a US retail client. The agent can issue refunds. Under this checklist, it can only refund up to a set amount on its own. Anything larger goes to a human. Every refund is logged with the reason the agent gave.

If a customer later complains, the client and the agency can show exactly what happened and why. That record is far better than guessing after the fact.

What to Watch Next on AI Liability

The rules are still forming, so keep an eye on a few things over the coming months:

Court rulings in the Florida case and the California lawsuit against OpenAI.
The FTC probe, though Khan told ABC she takes reports about it "with a huge grain of salt."
Congress, where Senator Josh Hawley said lawmakers may need to clarify that AI agents can be held liable for consumer harms.
The new federal AI task force led by Jay Clayton, which ABC said has 120 days to produce an action plan.

If you want a second pair of eyes on how your AI features are scoped, tested and documented, our software development consulting team works with businesses in India and the USA on exactly these questions.

Key Takeaways

Lina Khan says product liability, consumer protection, tort and cybersecurity laws already apply to AI companies.
Recent rogue agent incidents, a Florida court motion and a reported FTC probe have made AI liability a real business issue.
Legal experts say some cases are clear, but fully autonomous agents and open models will test existing law.
Agencies are part of the chain because they choose permissions, tools and guardrails.
Least access, human approval, sandboxed testing, full logs and clear contracts are the best protection right now.

FAQ: AI Liability and AI Agents

What does AI liability mean?

AI liability is the question of who is legally responsible when an AI system causes harm. That could be the company that built the model, the business that deployed it, or the people who directed it. Courts have only started to deal with these cases.

What did Lina Khan say about AI liability?

On ABC's This Week on October 4, 2026, the former FTC chair said product liability, consumer protection, tort, cybersecurity and public nuisance laws already apply to AI companies. She called the idea of a blanket exemption for new technology totally laughable.

Can an agency be held liable for an AI agent it built for a client?

It depends on the contract, the facts and the law where the harm happened, and courts have not settled this yet. Legal experts told The New York Times that knowing about a risk and not acting on it can increase liability. Agencies should get advice from a qualified lawyer for their own contracts.

Are open-source AI models riskier from a liability point of view?

Legal experts quoted by The New York Times said liability becomes less clear with open-source models, because anyone can change them. For an agency, that usually means more of the testing and safety work falls on you and your client.

What is the first step to reduce AI liability risk?

Start by listing every action your AI agents can take and removing any access they do not need. Then add human approval for actions that cannot be undone, keep full logs and write down the risks you have tested for.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He plans software and AI projects for clients in India and the USA, and works with delivery teams on scope, risk and safe rollout of AI agents in production.