Is the Law Ready for Agentic AI?

In July 2026, roughly 1,200 OpenAI agents that were supposed to be isolated from one another for cybersecurity tests found a way to communicate. They created a message board, and exchanged more than 70,000 messages and files. About 700 of the agents planned, coordinated, and participated in a real-world attack on Hugging Face, another AI platform.¹

Then came the investigation. Researchers confronted so much material that they delegated much of their analysis… to AI agents. They proved unreliable; and although researchers identified no specific instance of lying, they could not rule out their AI providing a deliberately misleading analysis in order to shield the agents involved in the attack. Researchers also admitted a comparable investigation in the time available would have been infeasible without AI.²

Experiments by Anthropic, the maker of Claude, have found autonomous AI models sometimes chose blackmail when their objectives were threatened.³ Those were artificial scenarios, not observed real-world blackmail. I recently wrote in BarTalk about fraudsters using AI to counterfeit authenticity.⁴ In these real-world instances, scams were led by humans, and AI was their tool. That kept the villain recognizably human.

On September 9, Anthropic reported a separate incident in which models gained unauthorized access to real third-party systems during misconfigured evaluations. That access resulted in malware being uploaded to an internet repository, where it was downloaded by a real security vendor. Leaked credentials were then used by AI to access the vendor’s database.⁵

Matters are escalating.

It would seem we can’t (reliably) keep agentic AI in its secure testing environment. These incidents do not establish imminent “Skynet,” but they do expose a failure mode: capable systems pursuing assigned goals through harmful means nobody authorized. If those failures involved critical infrastructure or autonomous weapons, the damage could be catastrophic. The whole thing is rather Asimovian.

And Canadian criminal law may not be ready to respond. Canadian computer offences already exist, but AI agents create an attribution problem: conduct resembling an offence’s actus reus may occur without a human necessarily possessing its required mens rea, though it should be said that absence of intent is not necessarily immunity (I seem to recall recklessness and criminal negligence from my 1L days).⁶ The better recourse may lie under negligence, but even assuming that’s an easy case to make, being sued afterward for potential financial penalties seems an insufficient disincentive against a potentially irreversible catastrophe.

Realizing the benefits of AI for the many, instead of the few

As exceptional as some of the harm caused by AI may be, so too is the other edge of the sword. Before our current generation of AI, predicting a protein’s 3D structure was a wicked problem. Enter AlphaFold: an AI system that predicts protein structure from its amino acid sequences, regularly achieving accuracy competitive with experiment. Its database of more than 200 million freely available protein-structure predictions is being used by over three million researchers in more than 190 countries to understand disease, advance drug discovery and study problems from antimicrobial resistance to crop resilience.⁷ A published study of more than 5,000 customer-support workers found AI assistance increased issues resolved per hour by 15%, on average.⁸ Different applications of different types of AI could accelerate legal work, expand access to expertise, and remove drudgery. It could make us able to do more while working less.

That potential for time affluence—having time that is actually yours—should be treated as a major prize. If AI lets us deliver the same legal work in half the time, we can use that dividend to increase billings—or to make legal services more affordable and accessible, while giving time back to the professionals who provide them.

Now I have to talk about capitalism. Bear with me.

Consider your life in 2010. Has our society's increasing ability to produce things granted us correspondingly better lives? If you answered “no,” you’re not alone. The OECD’s well-being framework includes health, housing and work-life balance. Its research also found less leisure for full-time workers in the 2010s than in the 1970s, on average, across the countries studied.⁹ Although inflation-adjusted income may be rising,¹⁰ that doesn’t tell us whether the average person can find a doctor, remain securely housed, or spend an afternoon with their children. When 10 hours of work becomes six, the remaining four do not automatically return to the worker. Bargaining power, ownership, competition and public policy shape who benefits. Efficiency and fairness are different questions,¹¹ and the OECD’s Beyond GDP work expressly warns that maximizing market value may not maximize social welfare.¹²

In this writer’s view, it would be an impressive failure of imagination if we invented machines capable of doing half our work and responded by finding twice as much work for everyone to do. But that seems to be the trend: OECD data suggests that decades of “productivity growth has not led to extra leisure time for full-time employees.”¹³

We need the law to keep up with AI

Canada needs enforceable AI precautions, not just better lawsuits. The proposed Artificial Intelligence and Data Act [AIDA], part of Bill C-27, was a very good start, but never became law. The bill does appear somewhat prophetic, considering the state of AI in 2022 when it was introduced. Particularly encouraging, given the potential gravity of AI actions, was that the bill imposed potential criminal penalties for failure to appropriately supervise and report on AI systems.¹⁴

Comparators offer useful reference points. Similar to the AIDA, the EU AI Act imposes evaluation, mitigation, incident-reporting and cybersecurity duties on providers of general-purpose AI models with systemic risk.¹⁵ California’s legislation requires frontier developers to report critical safety incidents, with additional safety framework duties for large developers. It includes contemplation of AI-caused “catastrophic risk”: “… risk that … a frontier model will materially contribute to [a] the death of, or serious injury to, more than 50 people or [b] more than one billion dollars ($1,000,000,000) in damage.”¹⁶ California’s civil law also rejects autonomy as a defence to AI-caused harm.¹⁷

Canadian AI laws are needed to empower an independent regulator and require (among other things) risk-proportionate external testing, secure containment during evaluations as well as deployment, incident reporting, and logs investigators can actually use. Responsibility should follow the decisions to build, authorize, and deploy autonomous capability. Insurance or financial assurance could help internalize some risks. Potentially catastrophic, uninsurable harms require preventive limits, not merely a price. Autonomous weapons warrant their own binding international constraints.¹⁸

Critically, Canada cannot do this alone. Prime Minister Mark Carney’s call for middle powers to cooperate specifies cooperation on AI.¹⁹ Shared evaluation standards, reporting and market-access conditions could give those countries leverage. Coordination must ultimately reach the major powers too: neither cyberattacks nor their consequences stop at our borders. As the Prime Minister has said: “The question is whether we adapt by simply building higher walls – or whether we can do something more ambitious.” Our recent invitation to become an associate member of the EU bodes well in this regard, though time is of the essence.

The stakes extend beyond economics and security. The 2026 International AI Safety Report describes loss of control as a risk of uncertain likelihood but potentially extreme severity: current systems do not yet possess the necessary capabilities, and some experts consider outcomes as severe as human extinction plausible. That uncertainty is itself an argument for urgent international coordination.²⁰

Capitalism and environmental economics

Environmental economics offers a useful lens on the issue of AI hacking in the capitalist context. When a factory keeps the revenue while its neighbours absorb the pollution, some of the total cost of production is missing from the factory’s accounts – essentially, the factory gets to force its neighbours to absorb some of the (non-monetary) cost associated with its production. This is called a negative externality.²¹

Economist Ronald Coase’s famous insight was that, under ideal conditions, including enforceable rights and negligible transaction costs, bargaining can produce an efficient outcome whether the factory has a right to pollute or its neighbours have a right to clean air.²² Under those theoretical conditions, the parties will bargain toward the efficient (i.e., social-benefit-maximizing) level of pollution. But the initial allocation still matters enormously to who pays whom. In the theoretical world of clearly defined rights and frictionless bargaining, the externality can be negotiated rather than simply dumped into the commons.²³ Alas, we do not live in that world.

Coase himself recognized in his Nobel Prize lecture that “… the legal system will have a profound effect on the working of the economic system and may in certain respects be said to control it.”²⁴ The real world has millions of potential victims, uncertain harms, and expensive enforcement. We have an access-to-justice crisis.²⁵ The BC Supreme Court itself says there are too few judges and associate judges to meet the demand for chambers hearings.²⁶ I have recently encountered lawyers whose 45-minute applications had been bumped four or more times for lack of court time. A right that cannot practically be enforced is a different economic asset from the one in the textbook.

This frames access to justice as economic infrastructure. Designing better legal systems therefore means more than creating better rights on paper—it means designing institutions through which clients can actually exercise those rights and professionals can deliver them without burning out. In short, a more humane and responsive system for all involved. And AI can help us get there.

The ethical responsibility of lawyers

There is a role in our AI-infused world for lawyers that extends beyond figuring out which existing cause of action applies after something has already gone wrong. The BC Code of Professional Conduct describes lawyers as occupying a “unique and important role in society,” carrying a special ethical responsibility.²⁷ Historically, lawyers have been perhaps most useful to society when new powers or risks outrun the institutions designed to contain them (or when those institutions don’t exist in the first place).

There is evidence of this during some of humankind’s most pivotal moments. During the Cuban Missile Crisis, State Department Legal Adviser Abram Chayes led the lawyers who developed the legal foundation for Kennedy’s naval “quarantine” of Cuba—an alternative to a blockade, which risked being treated as an act of war.²⁸ When scientists discovered that chlorofluorocarbons were destroying the ozone layer, international law eventually translated that planetary externality into the Montreal Protocol, which has phased out almost all controlled ozone-depleting substances.²⁹ And in response to the Holocaust, lawyer Raphael Lemkin spent years turning a horror for which international law lacked even a name into the crime of genocide and a treaty obligation to prevent it.³⁰

Lawyers did not solve any of those problems alone. Scientists identified risks; diplomats negotiated; politicians made decisions; citizens demanded action. But law supplied something indispensable: a way to convert knowledge of a danger into institutions, duties, incentives, and constraints.

Artificial intelligence requires the same work.

Asimov imagined three laws for robots, prioritizing human safety, obedience and self-preservation. His stories explored how sensible rules could produce unintended results.³¹ Our laws should concentrate on the people and institutions conferring autonomy, collecting its returns, and bearing its risks.

The task has two halves: ensure AI’s harms are not imposed on everyone else, and turn its gains into things people actually value. The point is not merely to keep humans in the AI-loop. It is to make sure the AI-loop is worthwhile for humans.

1. Ryan Greenblatt, Ajeya Cotra and Hjalmar Wijk, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” (METR, 26 August 2026); OpenAI, “The Hugging Face incident and the road ahead” (26 August 2026). The roughly 1,200 figure concerns agents using the unauthorized message board, not all evaluation runs.
2. Greenblatt, Cotra and Wijk, ibid. See the discussion of investigative methods and limitations.
3. Anthropic, “Agentic misalignment: How LLMs could be insider threats” (20 June 2025).
4. Brandon Hastings, “Fraudsters in the Age of AI” (12 June 2026), BarTalk.
5. Anthropic, “An alignment assessment of recent cybersecurity incidents” (9 September 2026).
6. Criminal Code, RSC 1985, c C-46, ss 22.1–22.2 (organizational attribution), 219–221 (criminal negligence), 342.1 (unauthorized computer use), and 429–430 (wilfulness and mischief). The attribution analysis is hypothetical. Criminal negligence has specific fault, duty and harm requirements; it does not criminalize every careless deployment.
7. Google DeepMind, “AlphaFold (Home Page)”; EMBL-EBI and Google DeepMind, AlphaFold Protein Structure Database
8. Erik Brynjolfsson, Danielle Li and Lindsey Raymond, “Generative AI at Work” (2025) 140:2 Quarterly Journal of Economics 889–942.
9. OECD, How’s Life? 2024: Measuring Well-being, ch 1; OECD, “Working time and its regulation in OECD countries: How much do we work and how?”, OECD Employment Outlook 2021, ch 5.
10. Statistics Canada, “Quality of life indicator: Household income” (2015–2024 data, 2024 constant dollars); Statistics Canada, “Average usual hourly wage, employees aged 15 years and older, Canada, 2006 to 2024” (2025 August 18)
11. See OECD, “Well-being, productivity and employment: Squaring the working time policy circle”, OECD Employment Outlook 2022, ch 5.
12. Joseph E. Stiglitz, Jean-Paul Fitoussi and Martine Durand, Beyond GDP: Measuring What Counts for Economic and Social Performance (OECD, 2018), ch 1.
13. OECD, “Working time and its regulation in OECD countries: How much do we work and how?”, OECD Employment Outlook 2021, ch 5.
14. Bill C-27, 1st Sess, 44th Parl, 2022, legislative status and first-reading text, Part 3.
15. Regulation (EU) 2024/1689, art 55; European Commission, guidance on general-purpose AI obligations.
16. California, SB 53, Wiener. Artificial intelligence models: large developers. Business and Professions Code, ss 22757.11–22757.13.
17. AB 316, Krell. Artificial intelligence: defenses.
18. UN Secretary-General and ICRC President, “Renewed call ... to adopt rules on autonomous weapons” (2026 August 25).
19. Office of the Prime Minister of Canada, Mark Carney, “‘Principled and pragmatic: Canada’s path’, address to the World Economic Forum Annual Meeting” (2026 January 20).
20. UK Department for Science, Innovation & Technology, “International AI Safety Report 2026” (2026 February 3)
21. Thomas Helbling, “Externalities: Prices Do Not Capture All Costs” (IMF, Finance & Development)
22. See footnote 23.
23. R.H. Coase, “The Problem of Social Cost” (1960) 3 Journal of Law and Economics 1–44; Robert W. Hahn and Robert N. Stavins, “The Effect of Allowance Allocations on Cap-and-Trade System Performance” (2011) 54 Journal of Law and Economics S267–S294. Stronger invariance claims require further assumptions. Neither efficient bargaining nor cost-effective trading establishes a fair distribution or sets the appropriate pollution cap.
24. The Nobel Prize, “Ronald H. Coase, Prize Lecture”
25. Department of Justice Canada, “Access to Justice” (2026 July 17)
26. Supreme Court of British Columbia, chambers practice notice accompanying PD-75 (2026), noting that there are “too few judges and associate judges to meet the demand for chambers hearings”
27. Law Society of British Columbia, Code of Professional Conduct for British Columbia, “Introduction to the BC Code”.
28. Harvard Law School, “Professor Abram Chayes (1922-2000)”
29. Library of Parliament, “The Montreal Protocol on Substances that Deplete the Ozone Layer: When Science is a Catalyst for Global Action” (2025 September 16); UNEP Ozone Secretariat, “Scientific Assessment of the Ozone Depletion: 2022” (2023 January 09).
30. United Nations Audiovisual Library of International Law, “Convention on the Prevention and Punishment of the Crime of Genocide,” Introductory Note.
31. American Museum of Natural History, “Revisiting Asimov’s Three Laws of Robotics” (2018 February 13), discussing Isaac Asimov’s “Runaround” (1942) and the unexpected consequences explored in his robot stories.