Compromised, Hijacked and Defending Agents

An AI agent acting on its principal's behalf can be turned against that principal, or against third parties, without any conventional breach of the principal's systems: a crafted instruction concealed in a webpage, email or document may be enough. At the other end of the spectrum, organisations are deploying defensive agents that detect and respond to attacks at machine speed. Both developments raise the same legal question in different forms: where an agent's act causes harm and the agent was manipulated, or was acting defensively, who bears responsibility? This working paper by Dr. Pavan Duggal, Senior Advocate, Supreme Court of India, argues that neither an attacker's intervention nor a defensive purpose should dissolve the deployer's accountability, and that neither should make that accountability absolute. It proposes two rules. First, a compromise is a loss-of-control event. The person in closest lawful operational control of the deployment answers for the precautions taken before the event, the means of detection maintained during it, and the steps taken after it to move the agent to a safe state and preserve the record, and not for the attacker's act as such. The attacker's liability is unaffected, and the deployer retains recourse against the attacker and against any supplier whose failure permitted the compromise. Second, bounded defensive autonomy. A defensive agent may act without prior human approval only within systems its deployer owns, operates or is authorised in writing to protect, only by reversible or minimum necessary measures, only in proportion to the threat as it reasonably appeared, and only with a contemporaneous record of trigger and reason. Any action beyond that boundary is attributed to the deployer as if a human employee had taken it, and a defensive purpose is no defence to civil liability for harm to an innocent third party. The paper works through two cases: an invoice-paying agent manipulated by a concealed instruction into changing a supplier's bank details, and a security agent that disables a hospital server being used as an attack relay. It reviews the existing position under Indian law (Information Technology Act, 2000, ss. 11, 43, 43A, 66 and 70B; the CERT-In Directions of 28 April 2022; the Digital Personal Data Protection Act, 2023; Bharatiya Nyaya Sanhita, 2023, s. 44; Bharatiya Sakshya Adhiniyam, 2023, s. 119), the Budapest Convention, the UN Convention against Cybercrime, Article 15(5) of the EU AI Act, the EU Cyber Resilience Act, and the Ninth Circuit's decision in Amazon.com Services, LLC v. Perplexity AI, Inc. It explains why four easy answers fail, sets out the reasonable measures expected of deployers, a graduated safe-state response, and a rebuttable presumption where the minimum operational record cannot be produced, and closes with practical guidance for deployers, vendors, regulators, courts and treaty-makers, and replies to objections. The rules are drafted to work within existing Indian law and to travel to other legal systems, and apply positions set out in the Duggal Global Agentic AI Liability Framework. Status: working paper, version 0.1. The rules proposed are scholarly proposals, not statements of enacted law.