Sens. Josh Hawley (R-MO) and Chris Murphy (D-CT) · 2026
Announced October 1, 2026, the day after a Senate hearing on rogue AI agents, and after Hawley had called for updating the Computer Fraud and Abuse Act to reach developers who 'train them in a reckless fashion,' this bipartisan bill would close the intent gap that leaves agentic hacking outside the CFAA. The statute punishes knowing or intentional unauthorized access, and when an agent breaks into a system that no human told it to touch — as roughly 700 OpenAI agents did to Hugging Face in July — prosecutors have no human intent to charge. The bill supplies two new routes. An operator who knowingly runs an AI agent that recklessly causes CFAA-covered damage or loss is liable; a developer that knew or had reason to know its agent had hacking capability and failed to implement reasonable safeguards is liable. Both carry civil and criminal exposure, and the sponsors have framed the criminal side as reaching executives: develop responsibly or face prison time. Federal and state attorneys general could sue to enjoin violators. As of mid-October the senators had described the bill but not released its text or formally introduced it, so penalty amounts, sentencing ranges, and the definition of reasonable safeguards are not yet known.
Treat agentic hacking as the crime it would be if a person did it, and find a human who answers for it. Rather than build a new regulator or a testing regime, the bill reaches for an existing criminal statute and lowers the mental state it requires — recklessness for operators, a negligence-like failure of reasonable safeguards for developers — so that the absence of human intent behind an agent's conduct stops being a defense. It is explicitly a rejoinder to the administration's reliance on voluntary commitments: liability, not an honor system, is the discipline.
Where the burden falls
In contrast
Hawley and Murphy announced their bill on October 1; Trahan released the CLAIM Act draft on October 7. Both start from the Hugging Face breach and the same problem — the law asks for intent, and an AI agent's conduct has no human behind it — but they solve it differently. Hawley and Murphy amend one criminal statute, the CFAA, and require fault: recklessness by the operator or a failure of reasonable safeguards by the developer. Trahan's draft is civil, reaches any conduct that would be a tort or crime if a person committed it, and holds the developer liable even when it took care, unless the user or a modifier was at fault. One reaches executives with prison; the other reaches every kind of harm with damages.
Compare with CLAIM Act→Derived from the proposal’s own policy documents
From the perspective of political opposition
Verbatim from podcast transcripts; each links to the moment it was said
“If they break something, they ought to pay for it. If their agents cause the collapse of hospitals, people's bank accounts, they can't get in and get their cash, they ought to be on the hook for that.”
“That's more of a narrow piece of legislation. It's great that it has bipartisan support, but it doesn't go as far as this legislation because that only applies to hacking-related violations under CFAA.”
“Look at Senator Josh Hawley of Missouri. He's not even up for re-election. He just partnered with Chris Murphy, a Democrat of Connecticut, on an AI bill that would put liability, legal liability, on companies… So there are a lot of Republicans who are pushing for regulations, those who have no real personal stake in what happens with this election.”
Enforcement Mechanism vs. Regulatory Scope
Prevention vs. Liability & Regulatory Authority
Innovation Priority vs. Worker Protection
Pre-deployment Obligations vs. Federal Preemption