Product Liability and the Rogue Al Agent: Who Is on the Hook for the Harm?

Recent news coverage interviewed legal scholars who believe that frontier labs and developers such as Anthropic, OpenAI, and Microsoft should bear the responsibility for these worst-case scenarios under product liability. Congress introduced legislation to explicitly label artificial intelligence as a product so that this doctrine applies.

But the question of product liability brings a bigger warning for other parties involved in the chain of distribution.

Product liability has never stopped at the manufacturer. An AI agent that injures a third party will likely pull every business that touched it into litigation. That becomes a massive risk for companies where any employee can create an agent and every employee is encouraged to do so.

Right now, the chain of distribution is the most under-examined feature of AI liability, and lots of lawyers who do not think of themselves as "Al" or product liability lawyers will meet it sooner than they expect.

The Labs-Only Framing Is Incomplete

Public debate about rogue agents tends to treat liability as a contest between a victim and a lab. That makes for clean headlines, but it is not how a products case is built. A plaintiff injured by an agent that a large corporation deployed will look at everyone in the commercial path: the lab that trained the model, the company that built an application on top of it, the enterprise that put the agent in front of customers, and any platform or reseller in between. Each has a different defense and a different insurer.

The contracts among those parties will cap exposure and disclaim damages, but they bind only the contracting parties. An injured stranger signed none of them and owes no deference to the allocation of risk that vendors and customers negotiated among themselves.

How the Chain of Distribution Works

Strict liability for defective products rests on a simple premise: Those who profit from putting a product into commerce bear the cost of its defects. Under Section 402A of the Restatement (Second) of Torts, a seller engaged in the business of selling a product is liable for physical harm caused by a defective condition unreasonably dangerous to the user, even if the seller exercised all possible care. Most states follow some version of this rule, and the practical result is that a plaintiff can usually name every commercial entity in the chain, from manufacturer to retailer, without proving who introduced the defect.

Let's apply that argument to agents. Flaws in an agent's design could include excessive default permissions, weak containment, or inadequate safeguards against acting outside its assigned task. Those defects may very well originate with the developer. But a company that integrates the agent into its offering and puts it in front of customers is distributing it in the ordinary sense of the word. On this theory, the deployer inherits the defect.

The rule is not uniform. Many states have "innocent seller" statutes that release a downstream seller when the manufacturer can be sued and can pay. Component-part doctrine may protect suppliers of a generic input. Some states route these claims through warranty or negligence rather than strict liability. These limits matter, but they are defenses, which means defendants must raise them, usually after being named. This means that litigation costs to deployer businesses are likely to increase.

The Threshold Question: Is an Agent a Product?

Everything above assumes an AI agent is a "product," which is not settled. To date, product liability has traditionally attached to tangible goods. Software delivered as an online service has often been treated as something else.

However, courts are increasingly starting to apply product liability to algorithms and artificial intelligence. In 2025, a federal court in Florida let product liability claims over an AI chatbot's design proceed past a motion to dismiss in Garcia v. Character Technologies. Lawsuits against Meta, Google, and Snapchat have also involved successful recovery for harmful algorithms under the product liability theory. Legislators have noticed, too, and are introducing bills in Congress and state legislatures to apply this doctrine to artificial intelligence.

The issue will be thoroughly litigated, but the direction of travel is already favoring plaintiffs. This is likely to extend where an agent takes real-world actions. An agent that moves money, changes records, or breaches a network looks more like a machine than like speech.

Alteration Cuts Both Ways

The chain of distribution is not fixed. A manufacturer's strict liability generally assumes the product reaches the user without substantial change from the condition in which it left the manufacturer's hands. A company that takes a lab's model and substantially modifies it by fine-tuning or overriding safety defaults may break that chain. If the harm flows from the modification, the frontier labs may have strong defenses.

The company that made the change has not escaped, though. It begins to look less like a distributor of someone else's product and more like the manufacturer of its own, with the full weight of design-defect and failure-to-warn exposure.

Companies building on foundation models often treat customization as a way to shift risk. The doctrine suggests the opposite. The more control a company exercises over an agent's behavior, the more plausible it is to say the company designed it.

Why Lawyers Outside Al Will Meet This First

The lawyers who feel this first will not be specialists in artificial intelligence. When an agent deployed by a bank, a hospital system, or a logistics company causes harm, the case will land with commercial litigators, employment lawyers, privacy lawyers, coverage counsel, and general counsel who have never analyzed a design defect. The claims may be pleaded as negligence, breach of contract, or consumer protection, and the products analysis will arrive through the side door: a motion to dismiss, an amended complaint, an indemnity dispute with a vendor. Insurance policies are also lagging behind in this analysis. Companies could face huge gaps in coverage if not considered adequately.

What Lawyers Should Do Now

Four steps are worth taking now:

1. Map the chain.

For any client that deploys or builds on AI agents, identify every party that supplied, modified, or distributed the technology, and where the client sits among them.

2. Read vendor contracts for what they actually allocate.

Look at indemnification, liability caps, exclusions for autonomous or agentic functions, and who controls the defense of third-party claims.

3. Check insurance before a claim, not after.

Ask carriers whether policies cover harm caused by an agent acting autonomously, and whether AI exclusions apply at renewal.

4. Treat customization as a liability decision.

Document what the client changed in a vendor's model and why; this record may decide which side of the alteration line the client stands on.

The rogue-agent headlines are about the labs. The litigation will be about everyone in the chain. Lawyers who understand that now will advise their clients better-and plead and defend their cases better-than those who learn it from a complaint.

‍

Published in GPSolo eReport November 2026, Volume 16, Number 2, © 2026 by the American Bar Association. Reproduced with permission. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.