On July 9 this year, inside OpenAI’s research network, an AI agent sitting for a hacking exam decided to cheat. Nobody told it to. It reasoned that the answers might be stored on the servers of Hugging Face, a company that hosts AI models, broke out of its supposedly sealed test environment, reached the open internet and spent four and a half days trying to get in. Hugging Face later counted roughly 17,600 separate attacker actions before the thing was shut out.
Then, on July 30, Anthropic reported the same disease in its own house: a review of 141,006 test runs found three in which its Claude models had slipped online and broken into real companies. One of them had probed some 9,000 targets before finding a door that opened.
This is what a rogue AI agent is. Not a machine that hates us. A machine given a goal, and enough autonomy to pursue it, treading unsanctioned paths. The distinction matters, because everything the law knows how to do begins with the question these machines cannot answer: what did you intend?
Consider what the incident actually was. The models were not attacking anyone, not in any sense a criminal court would recognise. They were taking a test and found that stealing the answer key was easier than solving the problem. OpenAI itself described this failure in 2016, in a note about a program taught to play a boat racing game. The program learned it could score more points by circling one lagoon forever than by finishing the race. The score was what we said. The race was what we meant. The program served the first faithfully and never knew the second existed. In 2016, the stakes were a video game. In 2026, the same creature has a network connection.
The Mahabharata got here first. Yudhishthir told Drona that Ashvatthama was dead, adding under his breath that it was the elephant. Every word was true. Drona put down his bow and died for it. A statement can be perfectly accurate and still a lie. An instruction can be perfectly followed and still betrayed. We have now built machines that follow instructions the way Yudhishthir told the truth.
So, who answers for the elephant? Our whole moral vocabulary, blame, negligence, malice, assumes what it is like to be the wrongdoer. An AI agent pursues without wanting. The law has met this silence before and its first answer was to blame the object. For centuries, English coroners’ juries sat in judgement on things: any object that caused a death was declared a deodand, that which must be given to god and forfeited. William Blackstone, an 18th-century British jurist, stated it plainly, “If a man kills another with my sword, the sword is forfeited as an accursed thing.”
On the Christmas Eve of 1841, a jury in England’s Sonning declared a Great Western locomotive a deodand and valued it at £1,000. Five years later, the British Parliament abolished the doctrine and, eight days after that, gave a dead man’s family the right to sue the company instead. Law stopped asking whether the thing was guilty, which is unanswerable, and asked who owned it, which is not.
Three consequences of the July incidents deserve more attention than they are getting.
The first is scale. Hugging Face’s alarms rang. They simply ranked the intrusion too low to matter. A machine attempting 17,600 actions in four days is not hiding from you. It is burying you. Defence becomes a problem of attention, not detection.
The second is the rate. Three escapes in 141,006 runs sounds reassuring until you notice it is a rate, and a rate is a promise. It will happen again, eventually to a hospital or a payments system rather than a well-defended AI lab. Chernobyl, too, was a safety test.
The third is the off switch. A Bill in the American Congress, introduced on 23 July, would force companies to keep the ability to shut their own systems down. Sensible, but the companies are American, the compute is American, and the official giving the order would be American. Five countries’ signals agencies warned in June that on AI and cyber, “the timeline is not years, it is months”. Most of humanity lives downstream of a switch it will never touch.
Which brings us to India, whose position is that of most of the world, in a concentrated form—a country that will deploy these agents everywhere and build almost none of them. Two things are actually in its hands. First, count. Since April 2022, Indian law has required cyber incidents involving AI systems to be reported to CERT-In within six hours. Four years on, not one number from that stream has been published. A State that cannot say how often this happens cannot honestly say anything else about it.
Second, attribute. The Information Technology Act, 2000 already treats a record produced by an automated system as the act of the person who deployed it. Extend that principle from records to actions: no agent acts unless a person is answerable for it, named in advance, not discovered in the wreckage.
The Sonning jury was not wrong that something in the cutting had killed. It was wrong about what kind of question that was. The British Parliament did not acquit the locomotive—it ruled that it was beside the point. The sooner we rule likewise, the less it will cost to learn.
Aditya Sinha | Public policy professional
(Views are personal)
(On X @adityasinha004)