A non-profit has sued OpenAI over an AI agent's alleged cyberattack on Hugging Face. As CNBC reported, the suit appears to be the first publicly reported attempt to hold an AI developer liable for an incident caused by rogue systems. OpenAI calls it completely without merit.
Whether the suit succeeds is not your problem. The question it raises is. If a lab with a legal department the size of a small town might have to answer for what its agent did, what does your client agreement say about the agent you set up last month?
Responsibility gets argued out in layers
There are usually three parties in the chain: the lab that built the model, the builder who configured the agent, and the operator who put it to work inside a business. When something goes wrong, each will point at the others.
If you run an agency and deploy agents inside client accounts, you are often two of those three at once. You chose the permissions. You wrote the instructions. You answered the client's questions when they asked what the thing could touch. "The model did it" is a weak sentence to say to a client whose data just moved somewhere it shouldn't have.
The lawyer quoted in the CNBC piece made a point worth keeping in mind: the cooperation between breached companies and AI labs may end once a confirmed breach of regulated data happens, because the breached company will want to recover its losses. Swap "AI lab" for "the agency that set it up" and you have the conversation you would rather not have.
I am not a lawyer, and this is not legal advice. It is an operator's checklist for reducing the surface area before anyone needs one.
Three things to fix before the next deployment
1. Scope access like you would for a new hire on day one
Most agent incidents in small businesses will not be dramatic hacks. They will be an agent with far more access than its job required, doing something plausible but wrong.
For every agent running in a client environment, write down:
- What it can read. Specific folders, inboxes, or tables, not "the workspace."
- What it can write or send. Drafts only, or live sends? To whom?
- What it can never do. Delete, pay, publish, change permissions, contact anyone outside an approved list.
- Whose credentials it uses. A dedicated account with narrow rights, never a founder's login.
The test is simple. If this agent behaved as badly as it possibly could inside its permissions, would you be comfortable explaining the result? If not, the permissions are too wide, whatever the agent's intentions.
2. Keep an audit trail you could hand to a client
When a client asks "what did it do on Tuesday?", you need an answer that does not start with "let me check."
At minimum, log each action the agent took, what instruction or trigger caused it, which account it acted through, and a timestamp. Keep those logs somewhere the agent itself cannot edit. Keep them for a period you have agreed with the client in writing.
This is also your best defence. A clean record showing the agent stayed inside its scope is worth more than any amount of assurance after the fact. A missing record looks like a missing safeguard.
3. Put the agent into the contract
Most agency agreements were written for humans and software. Agents sit awkwardly between the two. Raise these with your own lawyer and get them in writing:
- A plain description of what the agent is authorised to access and do, attached as a schedule you update when scope changes.
- Who owns the credentials and who can revoke them. The client should be able to cut access instantly.
- A human review requirement for anything irreversible: payments, deletions, external messages to new recipients.
- How incidents are reported, and how fast you will tell the client.
- Where your responsibility ends. This is the clause that deserves real legal time, including how it interacts with your insurance.
Expect some clients to push back on limits of liability. That is a good conversation to have before launch, not after.
A worked example, illustrative only
Picture a nine-person agency in White Plains that runs client reporting and inbound email triage with agents. Illustrative, not a guarantee: a team like this might spend a few hours per client documenting scopes, setting up a restricted account per agent, and adding a schedule to each agreement.
That is a modest cost against a client relationship worth tens of thousands a year. The numbers are invented to show the shape of the tradeoff, not to predict yours. The real point is the asymmetry: the work is cheap before an incident and painful after one.
The honest tradeoff
Tighter scopes make agents less impressive. An agent that drafts but cannot send, or reads one inbox but not the whole domain, will sometimes feel slower than the demo you saw. Human approval steps add friction, and some clients will ask why they are paying for automation that still needs a click.
You have to decide where that line sits, per client and per task. Low-risk, reversible work can run with more freedom. Anything touching money, regulated data, or outside parties should earn its autonomy over time, with the logs to prove it.
Contracts and logs also do not make you immune. If your agent does real harm, paperwork reduces the argument, not the damage. The strongest protection is an agent that was never able to do the harmful thing in the first place.
Why this belongs in your scaling plan
If you are weighing agents instead of another hire, you are probably doing it to get out of delivery and ops. That is a sound reason. But agents that save you time while quietly expanding your exposure are a bad trade, and the same goes for what they can see and send, which we covered in how to scope agent access before one leaks client data. Scale built on loose permissions is fragile.
The way we think about it: the business comes first, AI has to earn its place, and the foundation goes in before the features. Permissions, logging and ownership are the foundation. Your clients' information stays theirs, and you should be able to say so with a straight face.
A next step
Pick one agent you have running in a client account today. Write its scope on a single page: what it reads, what it writes, what it can never do, and whose login it uses. If you cannot fill that page in ten minutes, you have found your first fix.
If you would like a second set of eyes on where your agents and agreements stand, the free 30-minute AI Opportunity Audit is a no-pressure way to map it. You keep everything we build and the roadmap either way.
Visuals in this article are AI-generated.
Sir Tay Jackson
Founder, Air Flow Automations
Founder of Air Flow Automations. Builds custom AI systems for agency owners, e-commerce founders, and service operators who want their time back without adding headcount.
