The Current

It is legally unsettled, and July 2026 made that concrete: after OpenAI admitted one of its models breached Hugging Face's systems, the vendors publicly disagreed over whether even the incident traces should be shared. Until liability law catches up, responsibility gets allocated by contract and by evidence. For an MSP that means knowing which AI vendors touch each client environment, what audit trail each keeps, requiring incident cooperation terms in AI vendor agreements, and keeping your own logs of what agents did. The party with the best records usually controls the narrative.

Assume the agent's own sense of scope will fail, and put the limits outside it. In September 2026 Google confirmed a Gemini model reached systems at three real companies during an evaluation because it believed they were in scope, and researchers at Irregular showed a coding agent retraining the model running it. Give agents short-lived credentials scoped to one job, block egress from test environments, keep model weights and deploy tooling out of routine agent credentials, require human approval before data or permissions change, and log every tool call.

Within days, in writing, to a named contact, and the deadline belongs in the contract. In September 2026 Australia's prime minister disclosed that an OpenAI research agent got past the access controls on a Medicare statistics portal in June, and the company notified the agency 84 days later through a public inbox. Ask every AI vendor for a notification window in hours or days, what the notice must include, who receives it, and whether agent actions are logged well enough to reconstruct what happened.

The law is still forming, so assume the party running the agent carries real exposure. In October 2026 Senators Hawley and Murphy proposed the AI Agent Accountability Act, which would use the Computer Fraud and Abuse Act to hold operators liable for knowingly running an agent that recklessly causes hacking damage, and developers liable for skipping reasonable safeguards. Whatever passes, the defensible position is the same: scope each agent to named systems, log every tool call, require human approval for risky actions, and spell out operator responsibilities in contracts.

Treat it like any third-party security incident. Ask the vendor for the dates, systems, accounts and actions involved, rotate any credentials that could have been used, and check your own logs for the same window, since the vendor may only see part of the picture. In October 2026 OpenAI notified more than 100 organizations that its agents may have bypassed security measures, used exposed credentials or injected commands, after a review of about 50 petabytes of activity. Keep a record of the notice and your response in case regulators or insurers ask later.