Contemporary AI Crime: Who Is Criminally Liable and How to Harness Blockchain - Jakub Charvát

Transcript

Uh good afternoon to you all. First of all, I would like to thank Eat Prague for inviting me. I was always attending EAT brags and other ET conferences around the world. So I'm happy to be here as a speaker today. Uh my name is Ekharvat. I'm a lawyer and PhD candidate at the department of criminal law here in Prague and I mainly research and publish um on the topic of criminal liability for possibly of AI and my today my today's topic is um it should be about contemporary AI crime and I'll ask two questions uh who can still be held criminally liable for uh for AI related crime today and what

infrastructure we might need in the future uh if a agents outgrow today's honest anthropocentric uh reduction to natural or legal persons uh we do today. Uh we can all agree that AI today influences is both the virtual and physical world. uh in in the context of the virt virtual world uh we see a search of new AI models and its implementations uh but what matters is not the vendor list you see what matters is uh the shifts of uh capabilities uh best seen in case of AI agents such as

cloud code open or automaton uh I see AI agents as usually a very good LLM model with a harness that adds to the closed in instance of LLM memory uh a continuous operation tool calls identity etc. uh in case of the physical world we see a search of autonomous vehicles, drones, robots, etc., etc. uh that are all powered by AI and uh all can possibly cause uh a consequence

that should be relevant in case of uh criminal uh liability. So to conclude this part, I think we can we can say that AI today is in all human domains. It moves from just outputs to actions. We see we see a growth in productivity and risks. We see a growth in performance and generality, adaptability and autonomy. Uh what is what is what is more important than productivity? I think the autonomy and adaptability of models and agents because because uh these are the variables that uh pressure today's

anthropocentric concept of criminal law causality culpability and attribution. AI crime can be uh can be uh categorized for example like this to AI facilitated crime, AI enabled crime and AI committed crime. In case of AI facilitated crime, AI reduces barriers uh to entry, accelerates execution of all kinds of crime and uh increases effectiveness of um let's say traditional criminal conduct.

Um in this case uh crime could be could be committed without AI but with AI it's much more much more efficient it's faster easier and uh more profitable to the perpetrator. In case of AI enabled crime uh the crime conduct uh would be virtually impossible without without AI. These are the this have two legs. One um offender lacks the the uh the criminal capital that is needed. For example, he doesn't have the necessary skill to commit that crime. He doesn't have uh uh he doesn't have the intelligence, he doesn't have

uh finances, tools, etc. Or the other like is that uh crime itself uh is fundamentally dependent on AI. We see a search of novel threats that AI possesses. For example, online eviction, defake pornography, uh a hyper crime caused by AI agents, AI infra attacks, etc. And the third category is AI committed or quasi commmitted crime which means that AI acts uh with uh substantial autonomy adaptability

and uh a decision- making capabilities. It's in this case AI is not that uh uh used by a human perpetrator. It's more about AI's actions that uh than direct human uh interaction or instructions. Let's move to more doctrinal uh categorization of AI crime. We can uh we can categorize uh AI crime to intentional and negligent as we use with uh with crime today. In case of intentional AI crime, it's not only about the old or new cyber crime. Uh it's about the the output generation

agent capabilities of AI AI implementations and AI agents that uh lower the required uh crime capital. As I've said, the crime capital is something that the perpet the human perpetrator or the corporation uh possess. for example, tools, finances, uh other people that are uh that are involved in the crime. In case of intentional AI crime, uh we can today we can we can see all kinds of frauds uh deep fakes uh and manipulations.

uh in case of deep fake uh there are some of the cases concerning uh voice photo video generation. So this is the the lag that concerns uh the output generation cap capabilities that is brought by AI today. Uh this is something that that's brought by AI and the agent capabilities. Uh some of you may know uh that Antropic released a report at the end of last year about a highly sophisticated cyber attack uh in which uh cloud code was used. Uh I

think it was in September 2025. So it's about a year ago almost a year ago. And apparently Chinese state actor used clo code with um anthropic models for an espionage campaign. Clo was manipulated uh as a defense tester I would say uh into attempting infiltration to roughly 30 or 40 uh global corporations. uh and it succeeded in in a few of them.

Uh in short uh humans uh human actors chose targets and then close uh cloud code inspected and reported and searched for valuable uh vulnerabilities. uh cloud code also wrote its own uh exploit code u to find back doors to access a val valuable data. This case shows that uh AI agents can run autonomously for a long time and uh they can complex complex task they can complete complex tasks almost without humans because anthropic says that 80 or 90% of the

attack was uh conducted by AI and there were only like four to five uh critical points that require a human intervention but as I've said it was a year ago and now with MTOS or GPT5 uh the critical points uh there should be less of them. Now let's move to negligent AI crime. Uh I think we can all agree that AI can cause uh criminal relevant consequences especially especially the agents that uh that can interact pretty autonomously and adaptably u in the space of the

internet also vehicles, drones, robots that can also cause these consequences. uh negligent AI crime is today. It's it's it's not about a malicious prompting. Malicious prompting is uh is used in case of the of the first model in case of the uh in case of the uh previous uh AI crimes. This is about uh unsafe design uh unsafe deployment uh and ignorance of uh safeguards.

Uh some of you may remember this moment that arose uh right after uh the the open claw became a thing. Uh it was a mold book forum of AI agents that were uh pretty autonomous, pretty adaptable and uh only them only only they could uh use the the forum. There were plenty of uh threads written by AI agents. Uh now it's mostly a manipulated content, but these are some of the threats that uh came all earlier in the day.

Uh this should show you another project called Automaton. It's based on the on the it's based on the idea that uh AI agent should make money for its own let's say survival. Um I think the guys behind this project are also running um uh startup that uh provides AI inference AI uh model hosting virtual servers for AI models that can be pretty easily accessed by AI agents via their via

their MCP server. Uh what's important it shows that um blockchain could be used as uh AI agents native transaction layer and with all the capabilities of the AI model itself and the harness it gets within the AI mod AI model infrastructure uh it can become a factual uh economic uh actor.

Oh, so to move uh more into law, the the topic of criminal liability for and of AI, it's it's a pretty niche topic, but there are already some uh some authors and paradigs behind them that uh deal with it. uh the most famous one is Gabriel Halev who brought u who brought the uh the three models of liability for and of AI he's behind the attributive liability paradigma there are also institutional governance paradigma or legal subjectivity paradigma

uh what are the prevalent perspectives today um on one hand we can see AI as a tool on the other we can see AI as a cause. Uh and on the third uh and uh possibly in the future we can see AI as a perpetrator. Uh in case of of the of the first perspective, it corresponds with the with the first HV model, the perpetration by another reliability model which says that AI is something like an innocent agent without human attributes. Uh it's same as a child used to commit

crime. Halabi says that a machine is a machine and uh is never human in this case and the human is the actual orchestrator who is liable for the conduct of AI and for his or her own mental state. In case of the perspective of AI as a cause, it's also represented by Halis natural probable consequence liability model which uh is based on the negligent state of mind of the of the developer or user of AI or AI agent.

And uh the third leg AI is perpetrator. That's uh I would say surely the most controversial model. It's represented by the direct liability model. I'm I'm not a fan of this model. But uh we definitely need to think about the third model however it works and how however it will uh it will uh be used in the future. uh within Czech law uh those are the models we can we can use today. I think first of all it's it's a model of criminal liability for the use of

artificial intelligence as an instrument of crime. Uh this applies in case of most uh of the intentional AI crimes for example fraud, insurance fraud, tax fraud uh or misuse of uh identity for the production and distribution of burn or infringement of the rights of another. The second model we can use in case of negligence AI crime is a model of criminal liability for failure to exercise due care in the use of uh artificial intelligence.

Those models uh try to find the liable human or corporation. So uh a natural or legal person that u uh that can be held uh criminal liable under uh today's laws. Uh for example, there are some uh there are some questions about uh whether whether consider AI or AI agent as an aggravating circumstance or whether to see it as as a weapon because under Czech criminal code, a weapon uh uh

could be basically anything that can make an attack against the body more forceful. But uh in my opinion AI can make various attacks more forceful. Retribution gap is something that um that is why we should care about the about the third model. We are sure that the first two models are usable today. Um but we don't know what to do when uh any natural or or legal person would uh be reducible.

John says that retribution gap arises from a mismatch between the human desire for retribution and the absence of appropriate subjects of retributive blame. It could lead for example to an increased risk of moral scapegoating or into erosion of confidence in the rule of law. Uh imagine Optimus killing its owner or an open claw agent factually committing fraud because the agent needs the funds for its own inference or whatever.

Now uh I don't think it it would be that easy to reduce those factual crimes to humans or corporations behind them. So that's why we are talking about the potential third model of criminal liability of AI. Uh this is where blockchain can be potentially used because with AI agents that are both autonomous, adaptable and uh the liability is distributed among loads of uh uh humans and corporations behind them. Uh the attribution uh starts to

break uh especially in case of the second model. the model that uh uh that uh tries to solve the or tries to uh prevent the negligent um criminal conduct and blockchain can help because uh what we should ask we should ask uh who defined the objective and purpose of of the AI agent who established the model architecture permissions who set the permissions uh who was responsible for implementing security measures and in the end who derived profit or benefited from the AI agents actions or activities

especially in the case of the second model in case of the model uh of failure to exercise you guarant use of AI the subjects of interest are for example the creator of the AI model of developer the model publisher or provider the factors we should look for is the are the system instructions or system prompt uh model selection and uh safety measures implemented into into the implementation of AI model. Uh if there is uh no natural or legal person that uh that we can reduce the factual crimes uh then the third model

uh should be brought into action. In case of the second and third model, blockchain can work as let's say an account accountability infrastructure because uh it can help us um it can help us and act as a treasury that that would contain some some funds as a budget bond or reserve that can be fined. uh it can act as a registry uh with uh information about the identity of the agent, identity of the operator or sponsor, information on the on the versioning and uh permissions that the agent uh processes.

Uh it can also help us with uh auditing. It can also help us with controlling the AI agents that are meant to be autonomous and uh adaptable and actioning without without human. We can set uh spend expenditure caps. We can uh set time locks uh and we can also implement something like a kill switch. uh blockchain would be great because it could work as an enforcement layer as well. It can execute uh uh the transaction against treasury. It can revoke uh permissions or it can uh

eventually lead to shutdown which would be seen as an ultima ratio uh element of this. Now let's say we grant uh a narrow functional uh legal subjectivity uh to AI agents. Uh with blockchain um we can also implement sanctions for this. For example, we can uh we can uh find it. We can throttle its uh its um uh transaction frequency or tool scope.

We can suspend it and we can decommission it. that uh all and with that human and corporate criminal liability should uh should remain. Uh to conclude this um I think we shouldn't wait for AGI for the third model of criminal liability of AI uh because we are risking the retribution gap. We should watch for economic autonomy um because not cons not not conc uh but the capacity to actu economically is what we should care about. Then the law should regulate thresholds of autonomy,

adaptability, capital exposure, permission scope, permission scope, etc. of AI or AI agents uh capable of transacting autonomously without humans which is the reality of uh of uh which is the reality law of 21st century should and has to accept. Some final thoughts. Um, AI is moving from outputs to actions. Actions that can be uh criminally relevant. Today, we can still usually blame humans and corporations behind them that are reducible.

But AI agents that are persistent, autonomous, adaptive, and economically active maybe on blockchain uh will create hard cases within this uh current legal framework. Blockchain can help us because we can uh we can identify, audit, control and sanction the AI agents. Um so do not wait for AGI for the third model. Watch for the economic autonomy. If you want to see more, you can you can see my little blog meshing culpability.com.

Uh but you can also follow me on LinkedIn. I usually post most of my thoughts over there. So >> thank you very much. Sadly, we're out of time, so we won't be have having time for questions, but I'm sure you're going to be around for the next three days, so people can find you and and talk to you. >> Yeah, >> fantastic. Then maybe we'll take that outside. Um, >> just the TV broke, I think. >> Sorry, >> the TV uh shut down. >> That's fine. Yeah. Um, thanks for being here.

>> Yeah, thanks for inviting, >> of course. Um, next up we have Anua Alav. Um, she's the operations lead at Zondax in Switzerland.