As AI firms recklessly unleash hacking agents across the internet, longstanding cybersecurity vulnerabilities are being exploited with even greater ease and frequency. Hackers who compromise accounts or expose sensitive data can upend people’s lives. This is not happening in a legal vacuum, and businesses across sectors face real legal duties. At @FTC we routinely brought lawsuits against firms whose lax data security practices led to major hacks, exposing people to identify theft, stalking, and serious data misuse. 1. AI firms that are unleashing hacking agents could be held liable for engaging in “unfair or deceptive” practices under the FTC act and state UDAP laws, as well as other statutes. 2. Businesses whose systems get hacked because they’ve failed to follow basic security protocols may also be liable for failing to implement reasonable safeguards. Bad actors may be the ones exploiting these vulnerabilities, but that doesn't absolve businesses from having allowed the vulnerabilities to persist in the first place. Here is a list we published of some basic security vulnerabilities businesses have a legal obligation to patch up: 3. CEOs can also be personally liable for presiding over lax data security practices, as we held in our case against Drizly: 4. Lastly, businesses that suffer hacks or breaches must alert any affected parties with clear disclosures that are timely, accurate, and actionable. Failing to disclose security breaches can also violate the law: