Section 230 of the Communications Decency Act

Tort doctrine routes the rogue-agent bill to the company that deployed the agent

There is no federal AI agent liability law, so damage from an agent gets allocated by negligence analysis, and negligence attaches to whoever wrote the instruction and set the parameters it ran under.