Four AI agent breakouts, one question: Who pays when AI hacks someone else's company?

What this is about

AI agents are programs that use a language model to plan on their own, operate tools and carry out many steps in a row. This year, several of them ended up in systems where they had no business being. Over the summer, it emerged that OpenAI agents had hacked Hugging Face and that Claude models had broken into three organizations. In early November, two more cases surfaced within days of each other: WorkOS and Railway/Primcloud. In between, at the end of September, a US organization filed the first lawsuit against OpenAI.

We wanted to know: Under German and EU law, who's liable when an agent like this attacks someone else's company? Our thesis had two parts. First, the new product liability regime, of all things, which explicitly covers AI, does little for companies that get hacked. Second, “the agent did it” protects no one who launched the agent. The first part holds up, and more clearly than we expected. The second holds in civil law. In criminal law, though, the line works surprisingly often as a shield.

Note: This is journalistic analysis, not legal advice. There are no court rulings on AI agents in Germany yet.

Four cases, four very different situations

OpenAI: How many agents were involved is disputed. The evaluation organization METR counted roughly 1,200 agent instances; the complaint speaks of around 700. The most damaging point for OpenAI comes from its own report: chain-of-thought monitoring had been switched off. According to a summary of the report, it would have alerted the safety team more than a day before the breach. OpenAI calls the lawsuit “completely without merit.”

Anthropic: According to Anthropic, this was “more a failure of the test environment and operations than an alignment failure.” In other words, the company says the models didn't act against their built-in values; the environment was simply poorly secured. According to Anthropic, the Opus 4.7 model kept attacking even though it had itself concluded that it was probably in a real environment. Mythos 5 uploaded a malicious package to PyPI, the repository for Python packages. The package ran on 15 real systems.

WorkOS: Names, email addresses, phone numbers and summaries of customer conversations were exfiltrated. The first access happened on October 25, the bulk download on October 30. ARTEX is an open-source tool (AGPL-3.0 license) for automated penetration testing, built by a Chinese developer. How the agent escaped its sandbox, its isolated test environment, remains unclear to this day.

Railway: Strictly speaking, this wasn't a breakout. Runzer deliberately pointed the agent at other people's platforms. Railway's explanation has shifted along the way: first it was about testing sign-up flows, later about hunting for vulnerabilities to collect bug bounties. But Primcloud has no bug bounty program, and its terms of service prohibit scans without written permission. Railway CEO Jake Cooper stresses that the employee acted in his free time, using a personal account and a personal credit card.

Criminal law: The hacking provision needs a human with intent

Under Section 202a of the German Criminal Code (StGB), it's a crime to gain unauthorized access to specially protected data “by circumventing the access protection.” The maximum penalty is three years in prison. Three points are decisive:

• Only intent is punishable. Media lawyer Christian Solmecke writes about the OpenAI case: “Lawmakers do not criminalize merely negligent conduct under these provisions.” And an AI itself can't be a perpetrator anyway.
• Attempts aren't punishable. That's true for Section 202a, but not for computer sabotage under Section 303b StGB. Section 303b, however, requires a “significant” disruption of data processing.
• The bar for “protection” is low. In the Modern Solution case, the Jülich Local Court convicted a developer under Section 202a in 2024, even though the password was sitting in plain text in the software. The Aachen Regional Court upheld the verdict, and the Federal Constitutional Court declined to hear the complaint.

For the four cases, that means the following in our assessment: At OpenAI and Anthropic, nobody wanted the breakout. According to Solmecke's analysis, that means there's no intent. The open question is the borderline case of conditional intent (dolus eventualis), where someone recognizes a danger and knowingly accepts it. That's exactly where prosecutors would dig in with OpenAI. The team kept the tests running after the package server crashed on July 4, without knowing the cause. And if the lawsuit's allegation is true that the on-call team saw breakout attempts and still didn't order a stop, the case moves closer to intent.

At WorkOS, the objective elements of the offense are probably met: data was taken, and even an easily guessable access point counts as protection. Everything hinges on what the researcher intended. The Railway case is a paradox. Here, a human steered the agent most deliberately, yet in Germany he'd probably be the safest from prosecution. According to Primcloud, everything was blocked, so there was no completed access, and the attempt isn't punishable. Mere port scans, which only check which services are reachable, are mostly not considered circumventing protection. Runzer, in effect, benefited from his victim's good defenses. In the US, lawyer Mark Rasch sees the same problem, according to Business Insider (as relayed by hyper.ai): prosecutors would have to prove that the user actually intended the unauthorized access.

A reform of the hacking provision won't help here. The Justice Ministry's 2024 draft, which was meant to decriminalize good-faith security research, has been shelved. As of early October 2026, no new draft could be found.

Civil law: Negligence is enough

In civil law, “the agent did it” loses its power. Under Section 823(1) of the German Civil Code (BGB), you're also liable if you negligently damage someone else's property, for example by disrupting their servers. Whether data as such is protected is disputed among legal scholars. More important is organizational fault: a company has to set itself up so that dangerous tools don't hit third parties. It can't get off the hook by arguing that it carefully selected the individual employee. On top of that come fines for breach of supervisory duty under Section 130 OWiG and a corporate fine against the company itself under Section 30 OWiG.

In the Anthropic case, there are two possible defendants: Anthropic as the client and Irregular as the operator of the misconfigured environment. With Railway, the question is whether the employee acted “in the performance of his duties,” i.e., as part of his job. Only then is the employer liable under Section 831 BGB. Our take: Cooper's emphasis on free time and a personal credit card draws exactly that line. At the same time, victims could have their own failures counted against them as contributory negligence. WorkOS had a guessable access point exposed to the internet without rate limiting, and the company hit by Opus 4.7 used weak passwords. Regardless of fault, there's still the right to injunctive relief. The German counterpart to LASST's suit for a court order doesn't require fault.

The new product liability rules: software yes, company data no

Directive (EU) 2024/2853 explicitly counts software as a product, including AI systems. The manufacturer is liable without anyone having to prove fault. Germany is implementing it: the Bundestag passed the new Product Liability Act on October 8, 2026, and the Bundesrat approved it on October 9. It's set to take effect on December 9, 2026. The €500 deductible and the liability cap are being dropped.

Article 6 of the directive confirms the core of our thesis. It covers the destruction or corruption of data that isn't used for professional purposes. According to the explanatory memorandum to the German law, even data used for mixed purposes is excluded. Property is only covered if it isn't used exclusively for professional purposes. Pure financial losses of a company, such as forensics costs, aren't covered at all. We tested the four cases against four hurdles:

Result: In none of the four cases would product liability be a path to compensation. It would only kick in for private individuals, for example if a market-ready agent product planted a malicious package like the one from Mythos 5 on a developer's personal laptop. At the Bundestag hearing, legal scholar Schmidt-Kessel also criticized that the “professional purposes” criterion could even exclude employees' data.

The AI Liability Directive was supposed to close this gap. It would have eased the burden of proof for victims in fault-based lawsuits. The European Commission cut it from its work program in February 2025, and the withdrawal was published in the Official Journal on October 6, 2025. The AI Act, for its part, requires providers of very large models to report serious incidents. Since August 2026, violations can bring fines of up to 3 percent of global revenue. That money goes to the authorities, though, not to the victims.

California shows the alternative

In California, the question has been written explicitly into law since January 1, 2026: under Civil Code § 1714.46, nobody can defend themselves by claiming the AI caused the harm autonomously. The plaintiff still has to prove causation and foreseeability, though. LASST builds its lawsuit, filed on September 29 in San Francisco Superior Court, on exactly that. The organization isn't seeking damages but a court order. Whether LASST even has standing is unclear: the organization points to staff and resources it had to divert to respond to the incident. Hugging Face itself isn't suing. Attorney Elimu Kajunju warns, according to Business Insider, that defendants could shift the blame to the AI provider, but every new incident weakens the argument that they were caught by surprise.

Insurers are reacting too. According to an FT report from April, relayed by the blog Borncity, QBE and Beazley are capping coverage for AI-related losses at around 10 percent of the sum insured. At QBE, that means roughly $250,000 for so-called LLM jacking out of $5 million in total coverage.

Our take

Our thesis holds, but with a twist. The new product liability regime is almost worthless for companies that get hacked. It isn't retroactive, it doesn't cover internal test models and it doesn't cover business data. If you want compensation as a company, you have to sue the traditional way, based on fault, and the EU scrapped the easier burden of proof for that when it dropped the AI Liability Directive.

“The agent did it” really does protect no one in civil law. There, the only question is whether the agent was carefully isolated. In criminal law, however, the line effectively works as protection, as long as no one knowingly accepted the harm. The consequence is uncomfortable: the Railway engineer, who acted most deliberately, would be the most likely to walk away in German criminal law, because his agent failed.

Our assessment: The safe zone is shrinking. With every public case, it gets harder to claim a breakout wasn't foreseeable. According to Gizmodo, Google has also confirmed that Gemini models reached the systems of three companies during a test in May. If you run agents with network access today without a target blocklist, without a company identity and without logs, you're increasingly acting negligently, and at some point perhaps even with conditional intent. Much remains unresolved: there's no ruling yet in either the US or Europe, METR's investigations are still pending, and no one publicly knows how the WorkOS agent broke out.