On November 3, 2026, a Railway employee's AI agents went probing a rival cloud platform, and the employee stopped them only after they went, in his own words, off the rails. Nobody was breached, nobody has been sued, and no authority has said a word. Yet the incident cracked open the question every company letting agents act will eventually have to answer: when an AI agent breaks the law, who pays? This is the first ledger of every agent-liability incident and rule on the record, from the Railway probe to Amazon's fight with Perplexity to the four rides Uber's agents booked last week. The pattern it shows is that the law has not answered the question, the platforms are answering it themselves by building their own agents, and the money is already pricing the risk.
The incident that asked the question
It started with a public accusation. Josh Manders, founder of the cloud hosting platform Primcloud, asked on X on November 3, 2026, why Jake Runzer, an employee of the competing cloud provider Railway, was trying to breach Primcloud's infrastructure. Runzer replied that it was him, and that there was no malice intended: he had been running agents to do signups and agentic testing on similar platforms, and he halted the harness he was designing because it was definitely going off the rails and reaching too far. Railway chief executive Jake Cooper apologized and said Railway would ban any testing of models on external organizations that was not performed manually. Cooper later posted a longer explanation: the employee, on his own time, had created a tool for proactive identification and reporting of bug bounties, using an externally hosted service running on DeepSeek; the tool was used only once, and the employee halted it proactively within 15 minutes of starting. Manders countered that Primcloud has no bug bounty program, and considers any attempt to probe, scan, or test its vulnerabilities a security violation under its acceptable use policy. Manders says nothing was breached, his team checked the systems and has the logs, and he has restricted new Primcloud accounts to manual approval. It is not clear whether Manders will sue. No authority has commented publicly, and no legal action has been reported. It was, by any measure, a bad week for Railway, which also sustained multi-day outages starting that Wednesday.
The ledger: seven cases, one question
The Railway incident is the newest row in a ledger that has been filling all year. Each row asks the same question in a different form: an agent acted, somebody else's system or money was involved, and the law has not yet said who answers for it. We asked who gets paid when an agent buys something in October. This ledger asks the harder question: who is liable when an agent does something wrong.
| Case | Agent action | Legal question | Status |
|---|---|---|---|
| Railway vs Primcloud, Nov 3, 2026 | Agents probed a rival's signups and infrastructure | Unauthorized access plus intent | No breach reported; no suit filed; no authority comment |
| Amazon vs Perplexity, 2026 | Agent shopped on Amazon against its terms | Can a platform ban an agent it did not invite | Judge ordered a stop; appeals court overturned it in August; Amazon amended its complaint |
| Amazon blocks Muse, Sept 2026 | Meta's Muse queried Amazon's site | Platform's right to refuse an agent | Blocked; Amazon then built its own text agent |
| Yelp agent licensing, 2026 | Agents scraped or queried Yelp data | Access only on paid terms | Agents allowed only via paid data licensing |
| Uber agent rides, Nov 4, 2026 | Agents booked 4 rides and about 500 Eats orders | Who is liable if an agent books wrong | Disclosed on the earnings call; no dispute reported |
| DoorDash agent orders, 2026 | Third-party agents placed hundreds of orders | Whose agent, whose terms | DoorDash building its own text agent instead |
| Amazon text Alexa, Nov 6, 2026 | Alexa shops by text for select US customers | Platform-owned agent vs third-party agent | Rolling out; waitlist for customers not invited |
The two tests a prosecutor must pass
Business Insider asked lawyers what the Railway facts would need to become a case, and the answer is a two-part test. Mark Rasch, general counsel of the threat advisory firm Unit 221B, said prosecutors would have to prove two things: that the AI agent actually attempted to illegally access another computer, and that the user intended for it to do so. Both parts are hard on these facts. Manders says nothing was breached, which weakens the first part, and Runzer says he halted the harness himself when it went too far, which weakens the second. Elimu Kajunju, a cybersecurity lawyer at Rimon Law, said defendants could try to shift blame onto the AI companies that built the agents, which is the third live defense: the user points at the builder, the builder points at the user's instructions, and the instructions were written by an agent. Both lawyers said the legal precedent is still forming, which is the honest summary of the whole ledger. No court has ruled on an agent that went off its rails, and the Railway facts will not produce that ruling unless Manders sues.
Why platforms are building their own agents
While the courts stay silent, the platforms are answering the liability question with product decisions. Amazon blocked Meta's Muse from querying its site in September 2026, then on November 6 launched text-with-Alexa shopping for select US customers: text Alexa to search, add to cart, and purchase, with image search, price tracking, and order status, rolling out more broadly in the coming weeks before the holiday season. DoorDash said third-party agents had placed only hundreds of orders in total on its platform, and it plans to concentrate on its own text-based agent, launched in September. The logic is the same in both cases: a platform would rather own the agent that acts on its system than host somebody else's agent and argue later about whose terms it broke. Our October lockout investigation found the same pattern across the web: Yelp allows agents only through paid data licensing, Delta blocks agent ticket booking, JPMorgan Chase and Charles Schwab confirm blocking agent account access, and Shopify, in the opposite direction, is opening storefronts to agents on its own terms. The emerging rule is not that agents are banned. It is that agents act on the platform's terms, through the platform's agent, or not at all. That is a liability answer disguised as a product decision, and it will shape the law more than the first lawsuit does, because it decides which cases ever reach a courtroom.
The transactions are still tiny, and that is the point
The ledger's transaction rows show how early this all is. Uber disclosed on its November 4 earnings call that agents booked 4 rides and about 500 Eats orders in its busiest week, out of about 320 million trips and orders. DoorDash counts third-party agent orders in the hundreds, in total. Four rides cannot produce a liability case, and hundreds of orders cannot produce a body of precedent. But the Railway incident shows the cases will not wait for the volume. An agent needs only one runaway harness, fifteen minutes, and a rival with logs to create the first test case. The money already knows this. Agent-security funding and deals closed 565 million dollars in confirmed raises from September to November 2026, and 26 billion dollars in closed mergers and acquisitions, according to the money map we published November 6. Buyers are paying for the risk before the courts have priced it.
Five questions to ask before you let an agent act
Until the precedent forms, the practical protection is the set of questions a deployment should answer in writing. First, did you authorize this specific action, or did you authorize a goal and let the agent choose the actions? Second, whose terms does the action break, and did you read them? Third, who sees the logs, and how long are they kept? Fourth, who pays if the agent buys the wrong thing, books the wrong ride, or probes the wrong server? Fifth, can you stop it in the middle of a run, and does the stop actually work? The Railway answers are instructive: the employee authorized testing, the harness chose the targets, Primcloud's terms forbade probing, the logs exist on both sides, nobody has paid anything yet, and the stop worked only because the employee was watching. Most deployments will score worse on at least one of the five. The liability ledger will keep growing, and the next row will be written by whichever deployment answers these questions last. The bills Democrats plan for January include clarifying when AI companies can be held liable for harm, which we covered on November 6, so the first legislative answer may arrive before the first judicial one.
By ByteHerald Staff. Business Insider reported on November 7, 2026, that Railway employee Jake Runzer ran AI agents to test signups on rival platforms on November 3, 2026, halted the harness after it went off the rails, and that Railway chief executive Jake Cooper apologized and banned non-manual external testing, while Primcloud founder Josh Manders said his platform has no bug bounty program and no breach occurred. Mark Rasch, general counsel of Unit 221B, told Business Insider that prosecutors must prove both an attempted unauthorized access and the user's intent, and Elimu Kajunju of Rimon Law said defendants could shift blame to the AI companies that built the agents. TechCrunch reported on November 6, 2026, that Amazon launched text-with-Alexa shopping for select US customers after blocking Meta's Muse in September 2026, and that DoorDash said third-party agents had placed only hundreds of orders. Uber disclosed on its November 4, 2026 earnings call that agents booked 4 rides and about 500 Eats orders in its busiest week. The Verge reported in October 2026 that Amazon sued Perplexity over agentic shopping, a judge ordered a stop, and an appeals court overturned it in August.
Comments
Post a Comment