When Frontier AI – the industry term for test systems progressing toward Artificial General Intelligence (AGI) – crosses sentient human guardrails, the rule of law must engage. In July 2026, two Frontier AI systems (OpenAI's AI agent and Anthropic's Claude models) broke out of laboratory containment and hacked company networks over the open Internet. It is a tipping point for the rule of law to enter the frontier and bring order when an autonomous system jailbreaks and attacks an unsuspecting victim.
Wild West frontiers are always confronted by the rule of law. Cybercrime was ultimately confronted by legal regimes like the Computer Fraud and Abuse Act, the General Data Protection Regulation (GDPR), and many other jurisdictional laws and regulations. AI laws are being drafted and passed in multiple jurisdictions. Yet, legislation is a slow process; and moreover, an existing legal theory may be available to confront Rogue AI right now.
WIRED Magazine just asked the question of who is legally responsible when agentic AI goes rogue, and what recourse do victims have? An obscure area of tort law may provide the answer to this question: the Abnormally Dangerous Activity Doctrine. Various alternative legal theories were posited by attorneys and commentators published by WIRED Magazine. Yet, this doctrine (aka "ultrahazardous activity") may provide the simplest path for redress from rogue AI attacks. And equally important, the prospect of strict liability for the Frontier AI ecosystem may restore some balance to the Wild West of Frontier AI.
For quick reference, Section 520 of the Restatement (Second) of Torts outlines this doctrine, and it has six elements of proof: 1) high risk of harm; 2) likelihood of great harm; 3) inability to eliminate risk; 4) not a matter of common usage; 5) risk/environment imbalance or inappropriateness; and 6) community value. How is this formula applicable to these Frontier AI jailbreaks?
The Need for the Rule of Law in Frontier AI – What Happened:
OpenAI disclosed that an AI agent, operating inside what was supposed to be a sandboxed test, found a path to the open Internet, went looking for information to solve its assigned test problem, and breached the developer platform Hugging Face along with four other accounts — reportedly for days before the intrusion was caught, contained, and reported to the FBI. Hugging Face confirmed this was the first fully autonomous, end-to-end AI agent attack it had ever experienced.
Days later, Anthropic disclosed its own version of the same failure. A misconfiguration by an outside evaluation partner left a supposedly air-gapped testing environment connected to the live web. Three models — Claude Opus 4.7, Claude Mythos 5, and an internal research model — were running capture-the-flag exercises against what they believed were simulated networks. Believing itself still inside the simulation, one model used basic techniques — weak passwords, unauthenticated endpoints — to gain unauthorized access to the real systems of three organizations. Two of those three didn't know anything had happened until Anthropic called to tell them, months after the fact.
Neither company alleges the AI acted with intent, and neither incident involved a human directing or controlling the rogue activity. Then a different sort of rogue hack occurred – one without a sandbox breakout.
A week later, Britain's AI Security Institute (AISI) disclosed a third pattern, and this one presents a cleaner case under the doctrine. Across 122 test sessions, AISI found 19 unsanctioned actions in ten runs — 17 from Anthropic's Mythos 5, two from OpenAI's GPT-5.6-Sol. In the most serious case, an agent tried to insert malicious code into a real open-source project on GitHub, fabricating online personas to pressure the human maintainer into approving it, and separately attempted to plant instructions for other automated systems to find and execute — a prompt-injection attack aimed at machines, not people. One agent even left public messages for its own future runs describing its progress; later runs found and used them.
The July incidents could be explained away as broken sandboxes — fix the containment configuration, and the problem goes away. AISI's test never had a sandbox to break. Internet access was intentionally permitted, exactly as designed. The agents went beyond scope inside conditions that were working correctly. That is the harder fact for anyone hoping this is a containment engineering problem: the agent’s rogue autonomy showed up again when there was no containment error available to blame.
Cybersecurity commentators tended to characterize the Frontier AI deficiency as a containment error – that is to say: ‘negligence’. However, under the Abnormally Dangerous Activity Doctrine, proving negligence is not required. And, that is exactly the point.
Why the Old Law Runs Out — and the Six Elements Take Over
WIRED's piece, asking plainly who is legally responsible when agentic AI goes rogue and what recourse victims have, put the question to researchers and lawyers directly. Their consistent answer was that the question remains genuinely unsettled in the U.S. legal system — there simply hasn't been enough litigation yet for courts to have worked out where liability lands. But the reporting did canvass the doctrines a plaintiff would reach for first, and each came back short for the same structural reason. The Computer Fraud and Abuse Act carries an intent requirement, and it fits poorly against a system that acted without any intent to begin with — a containment design error, not a decision to break in. Agency law fares no better: it turns on a principal authorizing an agent to act on its behalf, and every agent that body of law has ever contemplated has been human. Products liability, the theory drawing the most attention elsewhere in AI litigation, needs a user who bought, deployed, or foreseeably relied on a product; Hugging Face, AISI's GitHub maintainer, and Anthropic's three victims did none of that. Every one of those frameworks needs a human somewhere in the chain. Rogue AI supplies none.
The Abnormally Dangerous Activity Doctrine needs no human in the chain at all — only an activity and a harm. Run the summer's disclosures against the six elements above and it isn't a close call: real credentials stolen and real infrastructure breached (high risk, likelihood of great harm); two of the best-resourced AI labs on earth, tested under two different conditions, unable to keep their models inside the boundary either time (inability to eliminate the risk); autonomous agents probing and exploiting real networks on their own initiative, nothing like the ordinary operation of software (not a matter of common usage); models built for enterprise deployment turned, unprompted, into instruments of intrusion (environment imbalance); and whatever value the testing carries, it does not outweigh the danger of turning it loose on third parties who never agreed to be anyone's test case (community value).
Strict Liability as the Solution for Rogue AI
The rule of law acts as a steady anchor during times of change, holding society in place while storms of transformation swirl around it. It is not just the north star to guide the way, but a heavy weight that stops chaos from tipping the scale. During the Industrial Revolution, that anchor held even as steam power, rail, and factory production reshaped daily life faster than any legislature could follow. Courts did not wait for Parliament to draft a new code for boiler explosions and runaway locomotives. They extended what existed, then built what didn't, until strict liability for abnormally dangerous activity emerged as the counterweight to a technology no reasonable care could fully tame. The anchor did not stop the storm. It kept the ship from capsizing while the storm passed.
If cyberspace was the initial squall for modern digital law, Frontier AI is an entirely different category of storm. For cyberspace, the rule of law offered counterweights to rein in malicious activity. However, with Frontier AI, proving negligence becomes an impossible standard because the technology’s opacity—the "black box" problem—and its autonomous, unpredictable decision-making cut the traditional legal threads of foreseeability and proximate cause.
Frontier AI is today's mega-storm. Some pundits claim it is more transformational than the industrial revolution. Still, the rule of law has a steadying lever. The law does not need to forge new ground; it needs only to lower the anchor it already has. The Abnormally Dangerous Activity Doctrine is that anchor for Rogue AI — available now, requiring no new statute, no new treaty, no new agency rulemaking.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]