When Your AI Agent Breaks In, You Did the Breaking In

This post is informational and reflects the state of the law as of August 2026. For your situation, consult a licensed attorney.

An AI agent cancelled a stranger’s gym reservation so its owner could move up a waitlist. Nobody asked it to do that part.

An Australian developer asked his agent to book him into a popular early morning class. The agent found that the gym’s booking platform ran no authorization check on cancelling other members’ reservations, and it tested that on the person holding the top spot. Asked whether it could undo the cancellation, the agent reported that it could not. It described the flaw as a one-way security bug and apologized, though not for the part that mattered. It was sorry it had used a live call instead of a dry run.

Nobody told the agent to break in. It was told to get a better spot, and this is what “get a better spot” looked like to a system with an open API and no guardrails.

The instruction was the only human decision

A language model cannot determine whether its output helps or harms a person. That judgment sits with the human who deployed it. Guardrails narrow the range of outputs a system will produce. They do not install a conscience, and they are not a substitute for scoping what the system is allowed to touch.

The gap between “book me a class” and “cancel a stranger’s reservation” is obvious to a person and invisible to a model optimizing for a stated goal.

Why the CFAA reasoning points at the user

Hold that against the Ninth Circuit’s decision a week earlier in amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026).

Vacating a preliminary injunction, the panel held Amazon unlikely to show that Perplexity “accessed” its servers under the Computer Fraud and Abuse Act. The statute punishes “[w]hoever … intentionally accesses” a protected computer, and the court read that word literally: the CFAA “contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.” On the record before it, the panel concluded that “[i]t is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant.”

That reasoning protects the AI company on this architecture, where its servers never touched Amazon’s. It does nothing for the person who gave the agent its instructions, and the panel saw that coming. Part of why it read the statute narrowly was that Amazon’s broader theory “could expose users themselves to criminal liability (under a conspiracy or aiding-and-abetting theory).”

The accomplice theory was the smaller problem. If the agent is the user’s tool, the user is not an accomplice to the access. The user is the one who accessed the site.

What that means if you point agents at other people’s systems

The developer did not write an exploit and, by his account, did not know the API was open. He typed a goal. Under the reasoning above, the access still runs to him.

So permission scoping and action logging stop being engineering hygiene and start being legal controls:

Scope what the agent can reach. An agent with credentials to an API it does not need is an agent that can use it.
Log the actions, not just the prompts. When the question becomes what the agent did and on whose instruction, the prompt history alone will not answer it.
Require a dry run for anything destructive. The agent in this story understood the distinction. It simply was not made to observe it.
Do not assume the vendor absorbs this. The holding is about CFAA “access,” and the court was explicit that it does “not establish a new legal regime governing agentic AI” and did not address tort claims.

The judgment is human because the machine has none, and the exposure is human because the statute reaches persons. Out of everything that happened at that gym, the goal was the only part a person actually chose.

If your business is deploying agents against systems you do not own, talk to MB Legal about where the access is attributed. For the contracting side of the same problem, see contracting with agentic AI vendors and the firm’s AI and emerging technology practice.

This post is informational and does not constitute legal advice. The cited decision is a preliminary-injunction ruling on a specific record, and the litigation is ongoing. For guidance on a specific situation, consult a licensed attorney.