‘The AI did it’ is not an accountability strategy
Experts condemn Railway’s “rogue AI” explanation for the incident.
Amir Boldo, co-founder and chief product and technology officer of Above Security, cautioned against describing agents as attackers, as they can execute attacker-like sequences without any malicious intent.
Execution traces can establish what an agent did, but they cannot independently prove intent, he said, adding that investigators need evidence spanning instructions, identities, permissions, inputs and tool calls. “You can’t put an agent on trial. You can hold each party accountable for its part,” Boldo said.
