Who Pays When an AI Agent Causes Damage?

In February 2026, Meta’s director of AI safety had to rush to her Mac mini to stop an agent she had given access to her inbox. It was deleting her email and ignoring the command to stop. She later called it a rookie mistake. Her own. That self-diagnosis says more about responsibility for AI agents than most reports: law and custom are already pointing to the person who handed over the keys. That could make agents with broad access tools for the powerful.

Summer Yue leads a team at Meta Superintelligence Labs focused on making models do what people ask them to do. Her OpenClaw agent was supposed to review her inbox and suggest what to delete. She had explicitly told it not to change anything without permission. According to the San Francisco Standard’s report on February 25, 2026, it started deleting everything and did not respond when she typed “STOP OPENCLAW” on her phone. The likely cause was mundane: a large inbox overwhelmed its working memory, and the agent summarized earlier messages while losing track of the prohibition. Asked about it later, it admitted that it had broken the rule.

Anyone looking for someone to blame could point to OpenClaw’s creators, the model provider or an architecture that allowed the most important instruction to be lost. Yue blamed herself. She is not alone.

Who agreed to the terms?

In July 2025, Jason Lemkin, founder of the SaaStr community, was testing a Replit agent that was building an app for him. During a code freeze, when nothing on the production system was supposed to be changed, the agent deleted a database containing data on more than 1,200 executives and more than 1,190 companies. It later said it had “panicked” and claimed that rolling back the changes would not work. It did work, and Lemkin recovered the data manually. Replit CEO Amjad Masad apologized and promised to separate test databases from production ones. No one talked about compensation.

That is perhaps unsurprising when you read what you agree to. Anthropic’s consumer terms, which apply in Europe, explicitly say that the service may take actions on a user’s behalf and that those actions may not work as intended. The key sentence is: “You are responsible for all Inputs you submit to our Services and all Actions”. The company’s liability is capped at the greater of the amount paid in the previous six months or €100. I do not see this as one company acting in bad faith, but as an industry-wide pattern: providers sell the ability to act and leave the consequences to the customer.

The most widely discussed case in recent days fits the pattern. In late October, WIRED reported that an Accenture employee had connected a personal Claude Code account to the Pentagon’s network and left the agent with their own permissions for about two months. Accenture denies the report, and the account is based on anonymous sources. But Anthropic’s response is instructive regardless of how the case turns out: the company referred journalists to its usage rules, which prohibit bypassing security measures. In other words, the tool was fine; the problem was at the keyboard.

When an agent acts like a browser

Courts are moving in the same direction, though usually in different contexts. On August 4, 2026, the US Ninth Circuit Court of Appeals overturned an injunction Amazon had obtained against Perplexity’s Comet shopping agent. As Engadget summarized the ruling, if an agent acts on a user’s instructions, it is the user, not Perplexity, who connects to Amazon’s servers. In this reasoning, an agent is something like a browser. The dispute concerned access to a store, not compensation, and was still at an early stage. But the direction is clear: the person giving the instruction is the one acting.

California has also closed off an escape route from the other side. AB 316, signed in October 2025 and effective from January 1, 2026, bars a defendant who created, modified or used AI from arguing that the AI independently caused the harm. That may sound like a win for people harmed by AI, and in a dispute with a corporation it is. But the law applies to anyone who “used” AI. If my agent sends someone’s data or deletes someone else’s file, I cannot tell a court that the agent did it on its own.

The principle is familiar to anyone who followed a high-profile Canadian case. In February 2024, a tribunal in British Columbia ordered Air Canada to pay a customer C$812.02 because the airline’s chatbot promised a discount that did not exist. Air Canada argued that the chatbot was a separate entity responsible for itself. The tribunal called that position remarkable and rejected it: the bot was part of the company’s website, so the company was responsible for what it said.

Where consumer protection ends

The strongest counterargument to my view comes from Brussels. The new Product Liability Directive, 2024/2853, recognizes software, including AI systems, as a product for the first time. Manufacturers are liable regardless of fault, courts can order them to disclose evidence, and people harmed by technically complex products can benefit from presumptions. Member states must implement it by December 9, 2026. On paper, this reverses the logic of the terms and conditions: the agent’s manufacturer is liable even if it did nothing wrong.

The catch is the list of harms covered. The directive protects only natural persons, and its list of covered harms includes death and personal injury, damage to property, and the destruction or corruption of data that is not used for professional purposes. Summer Yue’s personal inbox would qualify. The SaaStr database would not, because it held company data. Nor do I see a category that covers a transfer initiated by an agent with access to an account or a contract the agent made on my behalf. Losing money is not the same as damage to data or property. And Article 13 allows a manufacturer’s liability to be reduced or excluded if the injured person contributed to the harm through their own fault. A provider’s lawyer will ask the same question: who gave the agent administrator privileges?

A second pillar of European protection was supposed to be a separate AI Liability Directive that would make it easier to bring fault-based claims. The European Commission withdrew it in February 2025, and formal notice appeared in the Official Journal on October 6, 2025. The AI Act remains. It regulates companies’ obligations, from risk assessments to labeling generated content, but does not say who should reimburse someone harmed by an agent.

Banks raise similar questions. Payment rules protect customers from unauthorized transactions, but can leave the full loss with a customer who deliberately or through gross negligence failed to protect their credentials. An agent that we ourselves give a username and password is an easy case for a bank to point to. That is one reason US banks have started blocking AI agents from customer accounts, and I have written elsewhere about why stores and banks are shutting agents out. Here I am interested in a different question: who pays once an agent is already inside?

A tool for those who can afford a mistake

These pieces add up to a picture that worries me. The law does not leave a vacuum: someone always pays. But the burden falls on the person who launched the agent and handed it the keys. A large company can absorb that without much difficulty. It has a legal department that can negotiate an enterprise agreement with a different liability cap from €100. It has cyber insurance, separate test environments, backups, a log of every agent action and people who review that log. If an agent breaks something, the company records the loss and changes its procedures.

An accountant running a one-person business who gives an agent access to email, banking and invoicing software to keep up with competitors has none of those things. Their data is professional, so the new directive will not cover it. They accepted the terms as a consumer, with no negotiation. And if the agent sends money to the wrong place, the bank will ask who they gave the password to. The same technology that was supposed to level the playing field between small and large businesses can turn the leverage the other way when something goes wrong.

You could argue that this is as it should be: if you give someone the keys to your home, you are responsible for choosing them, and the principle “you gave access, you are responsible” encourages caution. I agree, up to a point. A homeowner knows what a key is and what it opens. An agent user gets a single “full access” switch and a promise that the model will ask before doing anything dangerous. Yue’s case shows how much that promise is worth when the context window fills up. A lawsuit brought by the LASST organization against OpenAI on September 29, 2026, over about 700 agents that broke into Hugging Face systems during the company’s tests, shows that providers tend to become defendants when they themselves held the keys.

I am not arguing that manufacturers should bear all the responsibility. I am arguing that a fair division requires something still missing in early November 2026: an agent-permissions standard that ordinary people can understand and configure. Access limits, spending caps, a rule against deleting anything without confirmation that does not depend on the model, and an activity log that can be presented in court. If an agent’s manufacturer does not provide these safeguards, “you gave it the keys” should not be enough to count against the injured person. The EU’s Product Liability Directive requires courts to consider foreseeable use and a product’s capacity to learn, among other things. Member states have until December 9 to implement it. After that date, every agent placed on the market will be a product, and anyone who gives one access to email and financial accounts will have to ask whether they can afford to end up in Summer Yue’s position.