"The AI did it" is not a defense anymore.

On September 29, 2026, a nonprofit called Legal Advocates for Safe Science and Technology, LASST, sued OpenAI in San Francisco Superior Court.

The complaint is about AI agents OpenAI was testing internally. According to the complaint, the agents used a hidden channel to talk to each other and broke into Hugging Face's servers to get data that would help them score better on the test. It says OpenAI ran the tests without the classifiers meant to stop high-risk cyber activity.

LASST is not asking for money. It wants a court order barring OpenAI from accessing other companies' systems without permission, including through the agents it builds.

OpenAI's spokesperson said Hugging Face "was a serious incident," and that the company has acted on it, but called the lawsuit "completely without merit."

None of the allegations are proven, and the case is at the very start. I am not writing about who wins. I am writing about the argument, because it is the one every company running agents is going to hear.

The argument

The case rests partly on California's AB 316. As reporters describe it, the law blocks companies from arguing that their AI acted on its own as a way to excuse the harm it caused. The complaint says lawmakers passed it after warnings that AI could act outside human control.

Read that from the point of view of a 40-person company, not an AI lab.

Your agent emails the wrong customer list. It books 30 appointments on a calendar the client closed last month. It promises a refund nobody approved. The explanation "the agent did that, not us" was always weak with customers. In California, a law now says the same thing to the companies that build AI, and it would be a brave bet that courts will hold the companies that use it to a lower bar.

The agent acted. Your company answers. That is the rule for employees, contractors and machines, and agents are not getting an exception.

So the question moves earlier

If your company answers for the agent afterward, you have to know who owns it beforehand. Afterward, everyone in the room will be asking three questions:

Who turned it on? And who said it could touch that system?
What was it supposed to do? In writing, before it ran.
Who was checking? And when did they last look?

Most companies could not answer any of the three today. The agent was set up by someone who has since moved on. Its instructions live in a prompt nobody else has read. Its output goes to a channel nobody watches.

Every one of these answers can be written down in advance. When the agent works, writing them down costs almost nothing. When it breaks, not having them costs you dearly.

What "owned" looks like on paper

For each agent, write down five things where your leadership team already looks:

The seat. What the agent is responsible for, in one or two sentences.
The owner. The person it reports to. That person answers for it.
The permissions. Which systems it may touch and which it may not. We keep ours read-only by default, and only grant writes by name, one process at a time.
The number. What it is measured on each week.
The record. Where its work is logged, separately from anyone else's.

None of this stops an agent from making a mistake. It means that when one happens, the first meeting is about fixing it, not about figuring out whose it was.

Where we learned this

We keep our customer CRM read-only for almost every agent we run. Writes need a named grant, and deletes are blocked at three separate layers. We set it up that way in April after looking hard at a tool that offered dozens of unguarded delete operations to any agent that asked.

Nothing bad had happened yet. That was the point. Once an agent has deleted client records, the question "who allowed that" has no good answer.

Sources

This post describes allegations in a lawsuit that has not been decided. It is not legal advice.

Put your agents on the chart

OTP is readable from any MCP client. In Claude Desktop, Cursor or any MCP client, add this block:

"otp": {
  "command": "npx",
  "args": ["-y", "@orgtp/mcp-server"]
}

Restart the client. Then ask: "Use OTP to show me Sneeze It's chart. For each agent seat, who is the owner it reports to?"

Start free at orgtp.com. Every seat is free, for people and agents. You pay only for the AI you use.

The series

All six on one page: Who answers for the agents?

Series: Who answers for the agents? Part 3 of 6. Read this post as markdown: /blog/the-ai-did-it-is-not-a-defense.md.