McGuireWoods partner Garen Marshall was quoted in an Oct. 8, 2026, Global Investigations Review article examining the legal implications for frontier AI developers that publicly disclose security incidents in which their AI models reportedly accessed other organizations’ systems.
The article discussed several security incidents disclosed by AI companies and explored how public disclosures can help companies build trust and explain what happened but may also create legal exposure. Marshall, a former federal prosecutor who leads McGuireWoods’ Artificial Intelligence Practice, discussed the “significant risks” associated with those statements.
“One is if they make a public statement and it turns out that it’s inaccurate or untrue, they’re potentially making misrepresentations that can lead to additional liability,” he said. He added that public disclosures “are then statements of the organisation that can be used against the organisation as evidence in enforcement actions or in civil litigation.”
Marshall also addressed the unsettled question of whether the Computer Fraud and Abuse Act could apply when a company’s AI model accesses another business’s systems without explicit human instruction. He explained that a key question is how to establish the requisite intent or knowledge when an AI system acts autonomously. As Marshall put it, “The law just hasn’t developed sufficiently to say under what circumstances would an AI system breaching another system provide sufficient evidence of intent or knowledge.”
Despite these legal uncertainties, Marshall acknowledged that companies have good reason to disclose incidents voluntarily: “If a company discloses the information, they have the first shot at framing what the facts are, what happened, and explaining it in a way that is consistent with their understanding.”
GIR subscribers can access the story here.