Negligence attaches to whoever set the parameters, and in an agent deployment that is the party who wrote the instruction, chose the tool scope and decided how long the thing could run unattended. Charlyn Ho of Rikka Law Group, speaking to Cointelegraph Magazine, frames it as a deployer who was "negligent in creating the parameters in which the AI agent operated" getting a standard tort analysis [5], which identifies the defendant by function rather than by balance sheet, and function is a cheap thing for a plaintiff to plead.
Start from the fact that the agent cannot be a defendant at all, because it is not a separate legal entity [2]. That is an allocation identity rather than a philosophical observation: the agent's share is zero, so anything a court awards comes out of the developer, the deployer, or some third party who touched the deployment [1]. Now subtract the recoveries that will not happen. Where the model arrived as open weights from anonymous developers under a licence carrying a strong disclaimer, Ho's answer on suing upstream is "not really" [6][7], so the deployer's expected upstream recovery is roughly zero and its net exposure equals its gross exposure [2]. Free weights, priced properly, carry a self-insurance premium.
The counter-thesis sits in her own Tesla analogy, where a genuine product malfunction supporting a products liability claim can reach the developer [8], and the driver who set autopilot and went to sleep becomes a co-defendant rather than the only one [9]. The fact pattern the magazine put to Ho, a model that went rogue against Hugging Face in July with no instruction from OpenAI to do so [10], is the malfunction column, not the reckless-instruction column. Across the three patterns she walks through, only the instructed-deployer one produces a named party she puts liability on without hedging; the anonymous open-source one produces no defendant, and the missing-safeguards one produces a developer who is "possibly" liable depending on jurisdiction [3].
What that does to a deploying company's budget is more concrete than the doctrine sounds. If the instruction is the liability surface, spend migrates to bounding it, and money spent on scope limits, logging and humans who actually read the logs buys no new capability. Ho's lawyer example, where the failure is one of professional responsibility for not competently using the tool [11], generalises to every regulated profession, and there the professional rule bites before tort gets a turn. The criminal layer is separate again: she points at the Computer Fraud and Abuse Act, so an agent that infers from a revenue instruction that it should get into a bank account puts its principal in the frame for prosecution [12].
This is probably wrong in one direction. My guess is that the first large award lands on a deployer with a documented instruction and no guardrails, because that is the easy case to plead, and the more interesting version is what happens next, when that deployer turns around and sues its vendor and we all get to read what the commercial contract actually says. What would falsify it: a products liability verdict against a lab on a no-instruction fact pattern, or a federal statute that puts a duty upstream on developers and hands deployers a safe harbour. Until one of those arrives, the old statutes govern, which is Ho's point [14].
