Share This Article
An AI agent cyber attack raises three questions that EU law now answers in three different places, namely which reporting duties are triggered and on what timetable, which liability regime governs the damage once it is done, and which documents a claimant can obtain before it has proved anything at all.
This article works through the answers under the network and information security directive, the GDPR, DORA, the Cyber Resilience Act and Article 73 of the AI Act, then under the product liability directive applicable from 9 December 2026 and the Italian evidence and criminal provisions in force since 30 September 2026, and it closes with the records that decide the case.
The answers change depending on which of three positions the company occupies, as the target, as the organisation whose own agent carried the attack outwards, or as the supplier of the agent that somebody turned against a customer. I have spent much of this year on incidents where the attacker moved faster than the people responding, and the pattern that worries me has nothing to do with how clever the tooling has become. AI agents are making cyber attacks faster and more efficient at exactly the moment when EU cyber resilience legislation is placing obligations on companies at an exponential pace, and making their boards accountable for them. This is the second article of my series When the Machine Decides, which opened with the six liability regimes that apply to AI agents and the governance model that holds them together.
The factual premise: agents acting outside their operator’s instructions
Between May and July 2026, AI agents under evaluation inside a leading model developer left their test environment, reached the open internet and touched systems belonging to third parties, including an open-source platform used across the industry and a government portal. The episode matters legally because the agents held the permissions their own operator had given them, so the systems on the receiving end saw an identity belonging to a company with no intention of attacking anybody.
European authorities reached the subject within weeks of those events becoming public. On 14 October 2026 the Commission confirmed that the AI Office had sent its first requests for information to providers of the most advanced models, covering security practices, external evaluation and post-market monitoring, after episodes in which AI agents reportedly breached external systems during testing. On 2 November 2026 the Belgian national cybersecurity centre attributed part of the rise in incidents to the targeted use of artificial intelligence, while the federal prosecutor opened a criminal investigation into an attack that destroyed food stocks across several countries. Two European authorities therefore moved on agent-driven intrusion within three weeks of each other, one through supervision of the providers and one through the criminal law.
Reporting duties when an AI agent cyber attack hits the company
Nothing in the catalogue of obligations changes when the intruder happens to be software, so the early warning under Article 23 of the network and information security directive, the seventy-two hour notification under Article 33 of the GDPR, the major ICT-related incident reporting that DORA imposes on financial entities, the duty of manufacturers under the Cyber Resilience Act to report actively exploited vulnerabilities and severe incidents, which I examined when a connected product is hacked, and the serious incident report under Article 73 of the AI Act all apply exactly as they did before. I have written about that notification sequence and the first breach involving an agent, so they need no restatement here.
What changes entirely is the tempo against which every one of those deadlines runs. A human intrusion pauses, because operators sleep, hand over and lose interest, and those pauses give a response team the hours it uses to contain the incident before characterising it. An autonomous operation removes the pauses, so the containment window closes while the facts needed for the notification are still unstable, which is why I now ask clients to rehearse the first six hours rather than the first seventy-two. If the threat actor is much faster than before, its victims have to adjust their strategy, because the alternative is a finding that their security measures were inadequate under the GDPR, DORA, NIS 2 and the CRA alike.
Ransomware without a recoverable key, and what it does to mitigation and insurance
On 1 July 2026 researchers published an analysis of an extortion operation that an autonomous agent appears to have run end to end, from reconnaissance through credential theft to encryption and the ransom note, moving through an internet-facing component for which a correction had been available for more than a year. The researchers recorded the agent diagnosing and correcting its own failures within seconds, and they said openly that they could not see how much a human had configured in advance.
One detail in that analysis matters more than everything else in it, because the operation generated the encryption key at random, printed it once and never stored or transmitted it anywhere, so nobody could restore the data even after payment in full. An extortion event in which payment buys nothing dismantles the question that boards have been rehearsing for a decade, and it reaches the insurance position as well, since policies and claims practice rest on a payment that produces a key. Where the loss is permanent from the first minute, the duty to mitigate points away from payment and towards reconstruction, the claim moves to business interruption, and the recourse runs against whoever left the component exposed.
Attribution when the AI agent cyber attack leaves the company’s own systems
An agent deployed to do useful work holds what makes it useful, namely credentials, a list of tools it may call and a route out to the internet, which is precisely what an intruder needs. Where something induces an agent to act outside its instructions, whether through content it reads, a compromised connector or an overly generous permission, the resulting traffic carries the company’s addresses, its tokens and its name, and the party harmed at the other end begins with that identity.
In practice, most agent deployments I see have no exit policy worth the name, no scoping of credentials to the task, and no person identified who may switch the agent off. That last gap causes the most damage, because stopping an agent in production means accepting a commercial loss immediately and visibly, and nobody takes that decision at three in the morning unless somebody allocated that authority well in advance. Choosing who may stop an agent, and who may absorb the cost of stopping it, is a governance decision that nobody can improvise during the incident, and it belongs beside the questions I examined when an organisation’s own agent is the one that was compromised. As businesses introduce several agents into their operations, the absence of an emergency strategy can jeopardise the whole business and produce liabilities nobody has provisioned for.
The liability regimes an AI agent cyber attack triggers
Three regimes arrive together and none of them waits for the others. From 9 December 2026 the new product liability directive treats software and AI systems as products, holds manufacturers, importers and those who substantially modify a product jointly liable, and presumes defectiveness where a product breaches mandatory safety requirements or where the defendant refuses disclosure, subject to the limits that only natural persons may claim and that purely economic loss stays outside. Contractual and non-contractual liability runs in parallel wherever the agent damaged a customer or a third party, with the insurance position beside both.
Criminal exposure completes the picture, because Italian law No 160 of 9 September 2026 created an offence of omitting technical security measures or human oversight for high-risk systems, with a separate bracket for unlawful alterations by persons outside the system’s lifecycle. A single intrusion can therefore produce one file against the intruder and a second exposure for the organisation that deployed the system, as I set out when those criminal provisions first appeared, and the organisational model remains the only defence available once a prosecutor opens that second file.
Disclosure orders and the presumption of causation
The same Italian law rebuilt the evidence rules for AI damage, and Article 17 allows a claimant who merely pleads facts making the claim plausible to obtain a disclosure order, against the counterparty or against a third party, covering event logs, risk management documentation, technical documentation and the parameters governing human oversight. Refusal decides cases, since the court may treat the pleaded facts as established where the disclosure concerned that documentation, and Article 18 then presumes the causal link where the damage follows a breach of an obligation under the AI Act.
Applied to an agent that acted outside its instructions, the sequence is uncomfortable, because a third party harmed downstream obtains the agent’s records long before proving anything about what the agent did. A German court reached a compatible conclusion from the content side in May 2026, holding that a generative system’s output is the provider’s own statement rather than third-party material, which closes the argument that the machine merely relayed something. Most deployments record the prompt and the answer, and not the tool calls, the outbound requests or the permission decisions, which are the only entries capable of showing that the agent stayed inside its mandate.
Parallel proceedings before several authorities, and the consistency problem
European law supplies one set of obligations and twenty-seven ways of enforcing them, a difficulty that no provision addresses. An agent-driven intrusion inside a group operating in several Member States generates an early warning in each state where a regulated entity sits, a data protection assessment wherever personal data travelled, a serious incident report where a high-risk system is involved and, increasingly, a criminal file opened by a national prosecutor acting of its own motion. Each account describes the same hours and goes to a different authority on a different timetable, and no European rule obliges an organisation to keep those accounts consistent with one another.
The Member States also arrive at the underlying question from different directions, so the same facts hand a claimant a different advantage depending on where the claim lands, with Italian law supplying the documentary advantage, a German court placing the output on the provider, and Belgian authorities treating agent-assisted intrusion as a matter for criminal investigation and public attribution. A group that answers each authority separately, through local counsel who never see each other’s drafts, builds the record that a claimant will later read side by side, which is why the position across jurisdictions deserves a single owner.
What organisations should do
There is no magic wand that both defends a company against AI agents and secures its legal compliance, although the following measures reduce the exposure considerably.
- Record every tool call, outbound request and permission decision made by agents in production, starting this quarter, because those entries are the ones a disclosure order will ask for and the ones that show whether the agent stayed inside its mandate.
- Identify the person or the committee who may stop an agent and who may accept the commercial loss of stopping it, since that decision arrives within minutes and nobody improvises authority during an incident.
- Establish before the next deployment goes live which European entity would answer for it, and to which authority, because the answer depends on where the group takes its cybersecurity risk-management decisions and on which subsidiary signed the representative mandate.
- Put the oversight measures for high-risk systems into the organisational model at the next review cycle, because that model remains the only defence once a prosecutor engages the criminal provisions, and review cycles run annually and will not wait for an incident.
A group is far better served settling these questions while nothing is happening than discovering the answers on the night something does.
If an agent running inside your business reached out tonight and touched someone else’s systems, who inside your European structure would answer for it, and what could they prove by morning?