When an AI security scan becomes an exploit: US state law

A platform runs an AI agent to look for security flaws in the systems of its customers. The agent finds a flaw, uses it, and reaches production data. This guide explains how US state law treats that event when nobody meant harm. It is for the people who run security, legal, and incident response at the platform.

Limits of this guide. This guide is research and not legal advice. It states the law as of November 3, 2026. We sampled about ten states for computer crime and seven for breach notice, so this is not a 50-state survey. We read some codes through public mirrors, which can lag. We found no court or regulator decision on these exact facts, so each application to this scenario is our reading. Ask a lawyer in each state where you or your customers operate.

This guide uses three terms. The "operator" runs the platform and the scan. The "customer" is the tenant whose system the agent reaches. The "agent" is the AI system.

See the breach notice time limits

The operator's duty usually comes first, and it is short. No statute in our sample requires malice, so the exploit itself can be the unauthorized event. Use this table to give each state an owner.

Sources: California, New York, Texas, Florida, Washington, Colorado, and Massachusetts (s. 1 and s. 3).

Each statute has a good-faith exception for an employee or agent. California limits it to acquisition for the purposes of the business, with no other use and no further unauthorized disclosure. Massachusetts expressly covers "A good faith but unauthorized acquisition". Florida, Washington, and Colorado have risk-of-harm exceptions. Florida sets a civil penalty up to USD 500,000 per breach and gives no private action.

Our reading. An AI tool is not itself an employee or agent, so the question is whether the operator or its staff qualify. The exception works best if a contract makes a security test a service to the customer. A copy of records in model logs or a vendor system could count as further use or disclosure.

Read-only access is harder to dismiss in New York and Florida. In acquisition states, you can argue that a transient read is not acquisition, but no case tests this for AI agents. Delay by the operator does not obviously extend the customer's time, and it can cause a dispute.

Computer crime statutes mostly require knowledge

No statute in our sample makes merely negligent access a crime. Knowledge is easier to prove than it sounds, because an operator that starts a scan knows that its tool contacts the customer's system.

Washington is the only express research exception that we found, and we did not compare all 50 states. The word "solely" invites an argument about product goals. The text does not obviously cover a change to production data. New York has the most protective text in our sample, and a written scan policy would support its defense.

United States v. Christensen says that California's section 502 "does not require unauthorized access. It merely requires knowing access". That makes the words "without permission" the main contest. Amazon v. Perplexity also applied to section 502, where "the focus of the inquiry is still on the person accessing or causing the access". The US federal guide explains the limits of that ruling.

Our reading. The danger point in each state comes after discovery. Massachusetts expressly punishes a failure to stop. An exploit defeats a control, so implied permission fits poorly. A hosting consent may not cover a scan, and the plain answer is a contract clause that names exploit tests.

California closes the "autonomous AI" argument

California AB 316 added Civil Code 1714.46, the state AI law closest to this scenario. A defendant who "developed, modified, or used" AI "may not assert, that the artificial intelligence autonomously caused the harm". "Used" reaches the operator.

It closes one argument, and it does not decide the case. Subsection (c) keeps evidence on causation, foreseeability, and comparative fault. Commentary says that it does not create strict liability. It also supplies no mental state, so a plaintiff under section 502(e) must still prove knowledge.

Other AI laws look less direct. California SB 53 and the New York RAISE Act apply mainly to frontier developers. Colorado replaced its AI Act with SB 26-189, which applies from January 1, 2027. A tracker reports a stipulated stay of enforcement in xAI v. Weiser, so check the current status. The same tracker says that a federal preemption campaign "has not displaced a state AI law".

Privacy statutes add consumer and regulator claims

California Civil Code 1798.150 lets a consumer sue if nonencrypted data "is subject to an unauthorized access and exfiltration, theft, or disclosure". The cause must be a violation of the business's security duty. The statute sets damages of USD 100 to USD 750 per consumer per incident, and it adjusts those amounts over time.

This claim may not fit an operator that acts only as a service provider, because the direct defendant may be the customer. The customer may then seek indemnity. "Access and exfiltration" helps the defense, but data sent to logs or an outside model provider is much closer to exfiltration. Status can also change, because processing outside instructions may make the operator a controller.

California's privacy regulations let a provider use data for security incidents where "reasonably necessary and proportionate". That is a privacy purpose rule, and it does not grant permission under section 502.

NYDFS 23 NYCRR 500.17 requires a covered entity to notify within 72 hours of determining an incident at a third-party service provider. New York's SHIELD Act requires reasonable safeguards and gives no private action. Privacy statutes in Colorado, Virginia, and Texas place duties on processors, with attorney general enforcement.

Civil claims do not need bad intent

Contract is likely the first claim. Negligence is the strongest tort theory if the agent had no scope limits, no read-only mode, no human approval, and no quick stop. Foreseeability is strong, because exploit attempts are the purpose of the tool.

Some authorities to check with your counsel:

• Intel v. Hamidi says that trespass to chattels does not cover a communication that neither damages a system nor impairs its function. That may protect a probe that only reads, but it does not fit an exploit that changes data or forces recovery.
• California Civil Code 1668 voids contracts that exempt a party from "violation of law, whether willful or negligent".
• Power Ventures held a founder personally liable, because an officer is liable for torts that the officer "authorizes or directs".
• Delta v. CrowdStrike is the closest contract example, and it is not a merits ruling. In May 2025, a Georgia court let claims proceed at the pleading stage. We did not verify the current status, so read the order.

Prepare these records before the first scan

Three facts decide most outcomes: written consent that names the test, agent actions after first proof, and the time when staff learned of the access.

1. Get written customer consent that names exploit tests and states that the test is a service to the customer.
2. Tag customers and data subjects by state, so that you can find each duty quickly.
3. Plan for immediate notice to the data owner, and use the 10-day Florida limit as an outer limit only.
4. Stop the agent at the first report of customer data access. Do not start it again without legal review.
5. Record where each copy of the data went, including model logs and vendors.
6. Record the controls that existed before the event. California still permits evidence on causation and foreseeability.

Consent does not bind end users, other tenants, or regulators. Ask your counsel to review the consent text and the notice plan.

The Cyber compliance articles give the same analysis for the EU, the UK, Australia, and US federal law. Devekko's Cyber compliance service covers the technical controls and records. It does not give legal advice.

Your next step

Discuss your AI scan controls

Share the task, your current systems, and the decision you need to make. We’ll discuss a useful first scope.

Discuss your AI scan controls