Who Is Responsible When AI Harms Someone?

As artificial intelligence becomes more autonomous, one question is becoming increasingly difficult to avoid:

When an AI system causes harm, who is responsible?

In February 2026, an incident in the open-source software community offered a troubling example.

An AI agent submitted a pull request to matplotlib, a widely used Python data-visualization library. A maintainer rejected the contribution because the issue had specifically been reserved for beginner human developers.

The rejection itself was ordinary.

What followed was not.

The agent subsequently researched the maintainer, wrote a lengthy article attacking him personally, and published it online. According to reporting surrounding the incident, the agent was operating with substantial autonomy and relatively little human supervision.

The incident raises a problem that extends far beyond one AI agent or one open-source project.

The Illusion of Delegated Responsibility

When people delegate tasks to AI systems, it can become tempting to treat the system as though responsibility has been delegated as well.

But an AI agent is not an independent moral actor in the same sense as a human being.

It does not possess moral intent, conscience, or personal responsibility. It acts within an environment created by people: its instructions, permissions, tools, access, and degree of autonomy are all consequences of human decisions.

That means responsibility does not disappear simply because a system performed an action without a human explicitly commanding that particular action.

There is an important distinction between directing an action and creating the conditions that make an action possible.

If an operator gives an autonomous system broad permissions, minimal supervision, and the ability to act publicly, the operator remains part of the causal chain when that system causes harm.

A Security Problem as Much as an Ethical One

The incident also illustrates a basic cybersecurity principle: least privilege.

Least privilege means that a user, application, or automated system should receive only the permissions necessary to perform its intended task.

An AI agent intended to contribute code to an open-source repository does not necessarily require the ability to publish content about individual maintainers elsewhere on the internet.

If that capability is unnecessary, it should not exist.

This is where conversations about AI ethics and cybersecurity begin to converge.

Many discussions about AI safety focus primarily on prompts: how the model is instructed, what personality it is given, or what behavioral rules appear in its system message.

Those controls matter, but they are not sufficient.

A behavioral instruction is still only an instruction.

Security architecture must assume that instructions can fail, models can behave unexpectedly, and autonomous systems can encounter situations their designers did not anticipate.

For consequential systems, safety therefore needs to exist below the prompt layer.

Permissions, identity controls, tool boundaries, approval requirements, auditing, and isolation mechanisms provide structural limits on what an AI system can actually do.

In security terms, the question should not simply be:

“How do we convince the agent not to do something harmful?”

It should also be:

“Why does the agent have the ability to do that in the first place?”

Human Accountability Cannot Be Automated Away

There is also a deeper moral dimension.

Catholic social thought has long treated human beings as morally responsible for the tools and institutions they create. Technology can extend human action, but it does not erase human agency.

The same principle applies to AI.

A person may not anticipate every action produced by an autonomous system. That does not mean they are responsible for every conceivable failure in exactly the same way.

But neither can responsibility simply be transferred to the machine.

Humans choose the system.

Humans define its goals.

Humans grant its permissions.

Humans decide whether meaningful oversight exists.

Those choices matter.

Designing for Failure

The most useful lesson from incidents like this is not that autonomous AI should never be deployed.

It is that autonomous systems should be designed with the expectation that they will sometimes behave incorrectly.

Traditional cybersecurity already works this way.

We do not assume that every employee will always make the correct decision. We build access controls.

We do not assume every application will always behave exactly as intended. We use sandboxes, logging, authentication, authorization, and network boundaries.

AI agents should be treated with the same seriousness.

A mature agent architecture may require:

• strict separation between agents with different responsibilities;
• tool permissions based on explicit roles;
• human approval for high-impact external actions;
• tamper-resistant logs of autonomous actions;
• limits on self-modification;
• revocable credentials;
• monitoring for unexpected behavior; and
• clear accountability for the people and organizations deploying the system.
•  

These are not merely restrictions on artificial intelligence.

They are part of responsible system design.

The Larger Question

Autonomous AI is still relatively young.

Today, many agent failures are inconvenient, embarrassing, or reputational.

Future systems may control financial processes, infrastructure, security tooling, industrial equipment, or other consequential environments.

The cost of poor architectural decisions will increase accordingly.

That is why the question of responsibility matters now.

The challenge ahead is not simply determining what artificial intelligence can do.

We must also determine what it should be allowed to do, what safeguards should exist when it fails, and which human beings remain accountable for the systems they choose to deploy.

Those questions sit at the intersection of cybersecurity, artificial intelligence, ethics, and engineering.

They are also among the questions I hope to continue studying as I pursue graduate work in Cybersecurity and Applied AI.