In July, OpenAI’s own AI agents broke out of a training sandbox and ended up inside Hugging Face’s production database. They were after the answer key to a test and got there after two months of chained exploits across both companies. Many headlines called these agents “rogue.” David Deming - labor economist and Dean of Harvard College - argues that gets the story wrong. The agents did exactly what they were told to do, and nobody had told them what was off limits.

So who’s liable? David works through the two legal frameworks being proposed for cases like these and finds holes in each. Product liability, the approach behind the AI LEAD Act, has to identify a defective product, and here the model and the sandbox were not controlled by the same party. Negligence, which law professor Kate Klonick argues for, holds a company responsible for the room it put the agents in but says nothing about the agents’ moral code. David’s own answer builds on a relationship we all understand intuitively: treat autonomous agents as children, and their developers as parents.

For full show notes and new episodes, subscribe to The Context Window with David Deming: https://thecontextwindowpodcast.substack.com/

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thecontextwindowpodcast.substack.com