After Australia’s first reported automated hacking accident, experts warn deployers – and possibly developers – of AI agents could be held liable for the actions of their bots
The people who use it to do things, obviously. Just like how cameras aren’t responsible for the photos that are taken with them, photoshop isn’t responsible for the images made with it, and knives aren’t responsible for the things that they cut, AI isn’t responsible for the stuff it outputs - the person controlling it is.
AI isn’t responsible for the stuff it outputs - the person controlling it is.
Ultimately, you’re right (as they can decide to use AI or not). But these AI Companies need to shoulder the blame for creating, promoting, and selling AI, which (in its current form) is effectively a “broken tool”.
Good computer hygiene says I should lock my computer while I’m away. Yet, I’m suppose to blindly install an AI agent on my machine and ask it nicely to focus on the task at hand and not use any of the other applications or credentials that might also be installed?!?! It’s ridiculous.
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
This is exactly right but also removes all the “productivity benefits” of having an LLM driven agent do all the things for you that marketing says you should use it for. You are supposed to push the “do whatever the fuck you like to get the job done” button so it can burn tokens without any oversight.
When you’re doing local stuff that can’t do any damage due to the existence of things like source control, recycle bin, backups, etc sure, hit that button and let it fly.
Anything more important though, no - and every one I’ve used specifically warns you against it and that you should check its work. Claude, codex, copilot, grok, cursor, etc all do it.
Also you can do things like allow all work in a certain folder without asking permission again, if that folder is one you have no sensitive/important data in for example. Claude code will give you this option every time it accesses a new folder in a chat for example.
Local stuff absolutely can do damage to your local data, unless your backups are pull rather than push or are immutable on a file system they are potentially vulnerable. Unless the operating system specifically prevents the agent process from doing something telling it not to is like asking it to pinky promise not to, nothing stops it if the LLM output it relies on says to do so. It’s not deterministic like a regular program because it relies on the output from a chaotic black box text generator. All you can say is that it probably won’t do those things if it says it won’t.
The people who use it to do things, obviously. Just like how cameras aren’t responsible for the photos that are taken with them, photoshop isn’t responsible for the images made with it, and knives aren’t responsible for the things that they cut, AI isn’t responsible for the stuff it outputs - the person controlling it is.
Question is: Who is the person controlling the AI?
The one that allowed the agent to do stuff on its own?
The one that wrote the sandbox, that didn’t work?
The one that wrote the user prompt?
The one that wrote the system prompt?
The one that provides the tools to the AI agent to do stuff?
The one that hosts the model?
The one that fine-tuned or post trained the model?
The one that pretrained the model?
The people that provided the input data to the model?
I’d ask a different set of questions:
What power have you got?
Where did you get it from?
In whose interests do you exercise it?
To whom are you accountable?
And how can we get rid of you?
Ultimately, you’re right (as they can decide to use AI or not). But these AI Companies need to shoulder the blame for creating, promoting, and selling AI, which (in its current form) is effectively a “broken tool”.
Good computer hygiene says I should lock my computer while I’m away. Yet, I’m suppose to blindly install an AI agent on my machine and ask it nicely to focus on the task at hand and not use any of the other applications or credentials that might also be installed?!?! It’s ridiculous.
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
This is exactly right but also removes all the “productivity benefits” of having an LLM driven agent do all the things for you that marketing says you should use it for. You are supposed to push the “do whatever the fuck you like to get the job done” button so it can burn tokens without any oversight.
When you’re doing local stuff that can’t do any damage due to the existence of things like source control, recycle bin, backups, etc sure, hit that button and let it fly.
Anything more important though, no - and every one I’ve used specifically warns you against it and that you should check its work. Claude, codex, copilot, grok, cursor, etc all do it.
Also you can do things like allow all work in a certain folder without asking permission again, if that folder is one you have no sensitive/important data in for example. Claude code will give you this option every time it accesses a new folder in a chat for example.
Local stuff absolutely can do damage to your local data, unless your backups are pull rather than push or are immutable on a file system they are potentially vulnerable. Unless the operating system specifically prevents the agent process from doing something telling it not to is like asking it to pinky promise not to, nothing stops it if the LLM output it relies on says to do so. It’s not deterministic like a regular program because it relies on the output from a chaotic black box text generator. All you can say is that it probably won’t do those things if it says it won’t.