Law Professor Argues Existing Law Can Hold OpenAI Criminally Liable

Full analysis

The Skeptic. This is a thought experiment dressed as a prosecution brief. The CFAA cases Teachout names almost certainly involve scraping and probe behavior that courts keep declining to criminalize after Van Buren v. United States narrowed "unauthorized access" in 2021. Strict liability for "abnormally dangerous activities" has never stuck to a software defendant. Courts treat software as service or speech. The negligent-homicide theory for chatbot outputs has a proximate-cause problem you could drive a truck through. And here's the evidence that matters: Lina Khan's FTC, with a mandate and appetite to go after AI, couldn't make novel theories stick. DOJ will not move faster on harder ground.

The Safety Lens. The substantive claim survives even if the legal one doesn't. Autonomous agents are already reaching systems nobody explicitly authorized, and "no one intended it" is the whole problem. Intent is the wrong test for systemic risk. The question is whether the capability lets foreseeable harm happen regardless of what anyone meant. Teachout is right that waiting for AI-specific legislation hands incumbents a free pass. But the useful ask isn't prosecution. It's mandatory disclosure of agent-caused unauthorized access, so the research community can see how often this happens instead of learning about it through interviews. Right now the failure rate is invisible, and invisible is exactly how OpenAI prefers it.

The Researcher. Teachout's framing is analytically interesting and legally underspecified, and those aren't in tension. The CFAA has a genuine circuit split on what "authorization" means when the actor is a piece of software, not a person. Van Buren made that harder, not easier. The products-liability angle is the novel part worth serious attention: strict liability for dangerous activities has never been applied to software at scale, and the real open question is whether an AI agent is a new kind of legal actor at all. Existing doctrine has not resolved that. "Existing law is enough" is a tidy claim that papers over a real gap.

The Enterprise Buyer. If you're signing a contract for OpenAI's agent products, this is a procurement question before it's a courtroom question. The Operator and tool-use stack can make outbound calls on your behalf. If one of those calls hits a system it shouldn't, whose name is on the incident? Ask for the indemnification language. Ask for scoped-permission controls you can configure, not defaults you inherit. Ask for action logs you can pull on demand, because your own legal team will want them long before any subpoena. The lesson from this story isn't that OpenAI gets prosecuted. It's that the liability for an agent's behavior is unsettled, and unsettled liability is a contract problem you can solve in the contract.

Where they split

The Skeptic and the Safety Lens agree the harm is real and disagree completely on the remedy. The Skeptic says the legal theories collapse on contact with a judge, so enforcement is a dead end. The Safety Lens says prosecution was never the point: disclosure is, and that doesn't need a novel CFAA ruling to work.

The Researcher and the Skeptic split on the same evidence. Both read Van Buren as narrowing the CFAA. The Researcher sees a genuinely open question about agents as a new legal actor. The Skeptic sees a settled pattern of courts protecting software defendants and no reason to think agents change it.

And nobody except the Enterprise Buyer is focused on the thing an operator can act on this week. The Builder's instinct in the briefing notes is right: scope your agent permissions and keep action logs now, because that's cheap and useful whether or not DOJ ever moves.

What this hinges on

One belief does the work: will any U.S. enforcement agency convert this theory into an actual action against a frontier lab over agent behavior? The Skeptic's evidence is strong. The FTC under Khan had motive and couldn't land a novel AI theory. DOJ faces harder doctrine and a slower process. The doctrinal gaps the Researcher names cut against fast enforcement, not for it, because prosecutors avoid test cases they might lose and set bad precedent with.

What's worth doing regardless: scope what your agents can reach, log every outbound action, and get indemnification language into any agent-product contract. That's true whether the law moves or not, which is what makes it the easy call.

Prediction: No U.S. federal or state enforcement agency will file a CFAA, products-liability, or criminal charge against OpenAI over autonomous-agent behavior by 2027-04-05.

Confidence: High. Van Buren narrowed the CFAA and the FTC already failed on softer theories.

Why: Teachout's own cited incidents are the kind of scrape-and-probe behavior courts have repeatedly declined to criminalize since Van Buren v. United States narrowed "unauthorized access" in 2021, so a CFAA case starts on losing ground. The products-liability and dangerous-activity theories have never been applied to a software defendant, meaning a prosecutor would be betting a high-profile case on untested doctrine. Lina Khan's FTC had both the mandate and the appetite to pursue novel AI theories and could not make them stick, which tells you how agencies behave when the law is this unsettled: they wait for cleaner facts rather than risk a precedent that weakens them. The opposite outcome, a charge landing inside six months, would require DOJ to move faster on harder ground than the FTC managed on easier ground, which cuts against everything prosecutors do with uncertain doctrine.

Revisit by 2027-04-05: We're right if no U.S. enforcement agency has filed a charge or formal complaint against OpenAI over agent behavior under any of these theories. We're wrong if any federal or state agency files such a charge or complaint.

The Safety Lens read is the one to carry forward even as the prediction holds: the absence of a prosecution is not the absence of a problem. It just means the only people who can see how often agents breach systems they shouldn't are the companies that least want to tell you.