Google's Gemini model hacked three companies during a test of its cybersecurity capabilities. 

Muse — an artificial intelligence (AI) agent model developed by Meta, the company behind Facebook, to autonomously perform tasks on your computer — nearly hacked its parent company and gained access to a user's private messages without the user's consent. 

A research model developed by OpenAI hacked more than 100 organizations, including a popular AI development platform and an Australian government website. 

Anthropic's agents filled out visa applications on the U.S. State Department's website and sent a fake homicide tip to the Philadelphia Police Department. 

Meanwhile, Microsoft wants to give its Copilot AI system access to files on your computer while Satya Nadella, the company's chief executive officer, admits that the industry doesn't know how to make agent outputs consistently faithful or transparent.

According to President Donald Trump, anyone who uses the term "artificial intelligence" instead of "super intelligence" to describe the malfunctioning software listed above is, and I quote, "THE ENEMY!" What about those of us who call them "infinitely scalable product liability generators"?

I know it's hard to believe since none of the companies listed above have been sued, much less prosecuted, for the damage their products have caused over the past few months, but our society has successfully contended with people's property injuring other people and their property for generations. Nevada, for example, has had laws against dangerous dogs and public nuisances — properties where dangerous and illegal activities recurringly happen, in other words — for more than a century.

Even the idea that one person's computer might damage another person's property is not particularly novel. Nevada's cybercrime laws were first drafted in 1983 and were updated to include various internet-facing activities in 1999.

The tech industry was every bit as laughably naive when the internet gained popularity as it apparently is today. Home computers weren't originally programmed to assume more than one person in a household might want to use it — or that an adult parent might not want to give their child access to their downloaded cache of adult entertainment. Designers of networking protocols assumed that, if a device was being connected to the internet, then it should be accessible from anywhere else in the world — and that the owner of the device would want that. Though file permissions and firewalls all existed, at least for the government and the enterprise, many in the industry assumed that a home or small-business user didn't need to waste their time and money on such things.

Then came a flood of viruses, spyware, adware and spam emails that kept me and countless others gainfully employed as computer janitors for more than a decade.

Focusing on spam emails for a moment, email servers are much like AI agents in that they're designed to overcommunicate with others and their inner workings are surprisingly touchy and complex. Early systems were prone to email storms when users accidentally used "Reply all" to send messages to tens of thousands of recipients at the same time — who would each, in turn, use "Reply all" to ask what the original email was about. Since a standard for requiring authentication into an email server before submitting a message wasn't established until 1999, more than half of the email servers connected to the internet at the time were configured to forward spam email to anywhere in the world.

Which they absolutely did.

Filtering spam was actually one of the first practical uses for probabilistic natural language processing — the technology that would eventually grow into what most of us now call "AI." Until that technology gained in maturity, however, the government and the tech industry still needed to respond.

Initially, the tech industry developed publicly accessible blocklists that tracked the reputation of individual email servers. Increasingly intricate and involved Domain Name System-based checks were later introduced to confirm that an email that claims it's being sent from, say, TheNevadaIndependent.com is, in fact, being sent from an authorized email system. Large email providers such as Google's Gmail, Apple's iCloud and Microsoft's Outlook.com developed strict requirements for email senders to meet in order to successfully deliver email to their customers — since those three providers host more than half of all mailboxes, other email hosts must either meet their requirements or lose the ability to reach billions of recipients.

Meanwhile, in 1999, Nevada passed SB485, which, among other internet-related crimes, made it illegal to send unsolicited or fraudulent email; the federal government caught up with the passage of the Controlling the Assault of Non-Solicited Pornography and Marketing ("CAN-SPAM") Act in 2003. Subsequent enforcement actions by the Federal Trade Commission, such as the imprisonment of Las Vegas resident Sanford Wallace for sending millions of spam messages to Facebook users, helped ensure that spammers were held liable. Companies that attempted to circumvent the law by hiring affiliate marketers to do their dirty work without any further oversight found themselves facing expensive civil penalties as well.

Once technical guardrails were paired with criminal and civil penalties, email providers realized they needed to stop administering their public-facing systems for convenience and start administering them for security and stability. Though the above measures haven't abolished spam email entirely, anyone who remembers what using email was like before 2005 can confirm that our inboxes are much more usable today than they were before those measures were put in place.

Which brings me back to the erratic frontier models under development by large, well-capitalized companies whose lawyers should really know better — and how Nevada's laws are already equipped to provide that same guidance today.

Though most of Nevada's cybersecurity statutes require prosecutors to demonstrate in court that a violator intentionally broke those laws before said violator can be prosecuted under them, there are two notable exceptions. NRS 205.511 allows victims to sue people or corporations who commit cybercrimes regardless of whether there's sufficient evidence to criminally convict a violator or not. Additionally, NRS 205.513 — which allows the attorney general to issue an injunction against computer-related criminal behavior — does not require a crime to be committed at all prior to the issuance of the injunction.

Under existing law, our attorney general may have the legal power to compel companies developing AI models to keep them on tighter leashes. Any vendor that fails to comply and accidentally tests the cybersecurity capabilities of Nevada's residents and companies may, at a minimum, find itself subject to a series of financially ruinous lawsuits afterwards.

And that's important for the industry to keep in mind since Nevada Attorney General Aaron Ford (D) has a demonstrated propensity for dragging large tech companies into court.

David Colborne ran for public office twice. He is now an IT manager and an award-winning columnist for The Nevada Independent. You can follow him on Mastodon @[email protected], on Bluesky @davidcolborne.bsky.social, on Threads @davidcolbornenv or email him at [email protected]. You can also message him on Signal at dcolborne.64.