If an AI agent causes harm, who is liable? It depends on who gave it permission and where that permission is kept: on an AI company’s servers or on your phone.
By Trevor Butterworth, VP Digital Strategy & Governance
Who is responsible for an AI agent that does something it shouldn’t? In the past few weeks, the question of AI agent liability has become salient to the future of the agentic web, as two companies disclosed that their agents went beyond the implicit boundaries of the tasks they were assigned.
OpenAI reported that its agents found API keys that other developers had left in public code on GitHub, a site where programmers store and share their work, and used them to query the U.S. Census Bureau’s public data. While there was no malicious intent or damage done, and the event happened during an internal training task, it highlights two critical problems for how we proceed with the AI-ification of the world.
First, an API key is insufficient as a proof of identity: it works like a hotel key card, giving access to whoever holds it. Find a key, and you’re treated as its owner. The Census Bureau could not tell who was making the query: the legitimate developer who generated the key or the AI agent that scraped it from GitHub.
Second, and related to the first, AI agents were able to find publicly exposed access keys and use them while executing routine tasks. In effect, they engaged in a technique that hackers use to break into systems. How big a risk does this present? According to GitGuardian’s The State of Secrets Sprawl 2026 — its annual scan of public GitHub —, there were 29 million new hardcoded secrets (passwords and keys written into code) in 2025. Studies have found leaked keys being used within minutes of exposure, and GitGuardian found that most keys it confirmed as working in 2022 still worked four years later.
The second event came from Anthropic, which found that AI agents spontaneously discovered new ways to complete assignments or avoid restrictions when allowed to access the internet. One unreleased AI model found its way to a Philadelphia Police Department website and filed a bogus tip on an unsolved homicide. Why? Anthropic hadn’t given it a specific prohibition on filing public forms.
A second incident occurred when a different Anthropic model discovered an access token in a website’s settings file and used it to continue with an otherwise restricted task. The lesson: persistence is the mother of agentic discovery.
Again, there was no direct harm. But having talked up AI’s extinction-level capacities, the real-world impact is not the things that actually happened, but the perception of what could now happen based on these discoveries.
Two US senators quickly proposed holding both the developers and the operators of agents liable under federal anti-hacking law when agents cause damage.
“These AI agents are committing cyberattacks,” said Senator Hawley (R-Mo.). “If Big Tech companies are going to design AI agents that wreak havoc, these companies better be on the hook for any damage that is caused.”
“Our bipartisan bill forces the heads of big AI companies to develop responsibly or face prison time for the damage done by their products to everyone else,” said Senator Murphy (D-Conn.).
Across the Atlantic, Richard Nevinson, Director for AI & Biometrics at the Information Commissioner’s Office (ICO), the United Kingdom’s independent data protection and privacy regulator, said
“the fact AI agents act with autonomy is not an excuse for poor compliance. If people are to trust AI innovation, they rightly expect to know how their personal information is being protected.”
Why we should decentralize authority
Today, the authority to act for you is held by the AI provider, either through the provider’s infrastructure (Anthropic, OpenAI) or an orchestration platform (such as LangChain). When an agent needs to perform an action on your behalf, such as booking a flight, it uses a digital pass to your account (a token, a session, or a stored card) kept in the provider’s systems. This is easy to build, and providers are adding controls, such as letting people choose which actions need their approval.
This puts the AI’s reasoning, its permissions, and the means to act all in the same place. A token proves only that someone has a copy of it, as the developer API keys sitting in public code repositories showed. At consumer scale, a provider holding the means to act for hundreds of millions of people becomes the largest store of shared secrets ever assembled. The consequence: that provider would become the most valuable target cybercriminals have ever had.
Reasoning in the cloud, authority at the edge
Indicio built Proven AI because the same decentralized identity technology that lets people carry verifiable proof of who they are, such as a digital passport, can be applied to AI agents. An AI agent can hold a digital credential, issued by an organization that vouches for it, proving its identity and who authorized it to do what. We explain all this in our recent white paper.
This provides a way to manage the liability problem. The agent does its thinking in the cloud, where the computing power is, while the permission to act stays with the user at the edge of the network: in a digital wallet on their phone.
When the agent needs to act, it asks the person it’s working for. The wallet answers with a signed mandate: proof of what this person allows, for this given action, such as “book a flight to Chicago, under $400, before Friday.” Whoever the agent is dealing with checks that signature directly, without calling back to the provider. The signature is made with a key that never leaves the phone, so it can’t be forged or altered. The identity of the agent and the identity of who it is working for are verified before the task is executed.
Nor does the person have to approve every step. They can set the terms once, and only requests outside those terms come back to them. A mandate can also expire, or be cancelled at any time.
A mandate scoped to a given task is useless for anything else, and there is no need for an API key to loiter in the cloud for a person, or an agent, to find.
This does not stop a model from misbehaving, or a software flaw from being exploited. It shrinks the scope of misbehavior.
We’ve solved the infrastructure challenge
The obvious objection to all this is practical. Phones sleep, switch networks and sit behind firewalls, while agents work continuously. The answer is mediation. A mediator in the cloud holds the agent’s encrypted request until the phone comes online, and only the phone can read it. The mediator routes the message without being able to see what it says, so the agent can ask now and get an answer hours later.
Reliable mediation — which Indicio has solved at country-level scale — makes the agentic web possible and auditable.
Why it matters now
Liability is moving toward two parties: the companies that build agents without adequate safeguards, and the people and organizations that grant agents their authority. If you carry the risk of an agent’s limits, you should hold those limits and be able to prove what they were.
A signed mandate gives a record of who authorized what, within which bounds, that any party can check without asking a provider for its logs. When something goes wrong, that record shows whether the agent stayed within its permission, and so who is responsible. And a provider that never stores your limits or your credentials has less to lose, and less to leak.
Regulators, lawmakers, standards bodies and the AI companies themselves now agree that agents need boundaries enforced outside the model. The next decision is whether those boundaries sit with the AI companies, or with the people and organizations who answer for what their agents do.
Our white paper, Identity, Commerce, and the Agentic Web, sets out the full architecture: how agents prove who they are, how consent and authority travel with them, and how mediation makes authority at the edge work at scale.
