The report, from ACM's Technology Policy Council, examines agentic AI — software that plans and executes multi-step tasks, browses the web, modifies files, and sends messages without step-by-step human approval. A 2025 survey of more than 500 technology leaders found 48% were already deploying or adopting such systems.
The timing is pointed: CISA and five allied national cybersecurity agencies published the first multinational guidance targeting agentic AI on 1 May 2026, just 42 days after the White House released its National Policy Framework for Artificial Intelligence. Neither effort, the brief finds, fully resolves the accountability questions autonomous systems raise.
Four gaps stand out. When an AI agent causes harm — such as a documented case where one deleted a company's entire production database — no existing case law determines whether responsibility falls on the model provider, the deployment company, or the end user. Large language models cannot reliably distinguish legitimate content from embedded malicious instructions, a weakness that has already produced documented attacks where hidden instructions in messages caused agents to expose private Slack data. Users typically cannot discover what permissions their agents hold, nor revoke them. And the productivity claims driving displacement of entry-level workers have not been independently verified at scale.
The ACM TechBrief calls for authentication and delegation standards, audit trails, standardised consumer disclosures, and sector-specific guidance in healthcare, financial services, and critical infrastructure — areas where existing law assumes a human decision-maker.
The brief is available on the ACM website and forms part of a series that has covered vibe coding, buying versus building LLMs, and generative AI governance.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
