From Answering to Acting: Why Computer Use Shifts the Liability Question

August 19, 2026 was the densest day of this summer, at least for anyone running agents. Anthropic took the computer use tool out of beta and introduced a dedicated browser tool that drives a hosted browser; the same day, the Skills API left beta status. Remarkably quiet for a step of that size.

More interesting than the tools is what they do to your class of error. Until now, the worst case for an AI application was a wrong answer — expensive in the individual case, but correctable before it takes effect. An agent that moves a mouse and keyboard and submits forms at third parties produces a different kind of error: a wrong action. That one can no longer be corrected, only unwound. The difference is larger in law than in engineering.

At a glance

• What applies: Since August 19, 2026, computer use (computer_toolset_20260801) and a new browser tool (browser_toolset_20260801) are regularly available — production-ready, no longer beta.
• What follows: The risk moves from “wrong answer” to “wrong action”. The OWASP list for LLM applications 2026 lifts Excessive Agency from rank 6 to rank 3 — for the first time on the basis of real incident data.
• The catch: The only German judgment that states the attribution clearly concerns statements, not actions — and it is not final and binding.

What became available on August 19

This summer’s new features, at both major vendors, are not about model intelligence but about running agents.

Tool (date)	What it technically does	What an error means
Computer use, out of beta (19/08)	drives a computer via screenshots, mouse and keyboard; new: batched actions, zoom on	an entry in someone else’s interface that nobody read
Browser use, new (19/08)	drives a hosted browser — navigation, clicks, forms	a transaction submitted at a third party
Skills API, out of beta (19/08)	reusable work instructions, loadable from a repository	an error that repeats in every run
Session budgets (07/08)	hard cost ceiling per session, stop with budget_reached	without a budget: a run that quietly continues

Alongside came domain lists (allowed_domains / blocked_domains) for web search and fetch, compliance transcripts for local sessions too (11/08), and on August 14 the largely autonomous mode as the default.

On August 3, 2026, the OWASP list “Top 10 for LLM Applications 2026” appeared, for the first time with real incident data in the ranking: Excessive Agency — authority to act drawn too widely — rises from rank 6 to rank 3. That a ranking which shapes requirement specifications towards service providers pulls this category upwards matters more for procurement than any benchmark table. And since July 27, 2026, European regulation itself recognises “Agentic AI” as a technology category of its own (Annex XIV of the AI Act, code AIH 0401).

The legal footnote: a judgment about words

There is no decision on acting agents. There is one on speaking agents — clear enough to show the direction.

The OLG Hamm (Higher Regional Court of Hamm) ruled on May 12, 2026 (case 4 UKl 3/25) on the chatbot of a provider of cosmetic treatments. The bot claimed that the managing directors, who worked as physicians, were specialists in plastic and aesthetic surgery. The qualification was missing; two of the titles named do not even exist as medical specialisations.

What matters is the reasoning. The court attributes the bot’s answers to the operator as its own conduct — as a perpetrator (Täter), not as an interferer (Störer) and not merely as someone who breached a duty to monitor. The load-bearing point: the business creates the operational framework and has sufficient control. The evidence for that is uncomfortably simple — it had reprogrammed the bot without difficulty after the complaint. The argument that a language model is an uncontrollable black box is expressly rejected, with the parallel drawn to software-based document generators, for which the Bundesgerichtshof (BGH, Germany’s Federal Court of Justice) affirmed attribution long ago. And the key sentence: generic notices such as “AI can make mistakes” do not reliably protect.

The legal status must be read along with it: the judgment is not final and binding. The court allowed an appeal on points of law (Revision) to the BGH because of its fundamental significance. Anyone selling this as settled law is selling something the BGH may still overturn. A risk signal, not the final state. What does apply without reservation is Art. 50(1) of the EU AI Act: since August 2, 2026, a chatbot must be identifiable as AI, with no transition period. I have set out both together in Using AI in customer service in a legally sound way.

Where the argument holds and where it ends

The obvious inference reads: if a statement already creates liability, an action does all the more. I consider the inference correct — but it deserves three objections.

First: it is an argument, not a holding. The OLG Hamm decided on unfair-competition grounds — the Unterlassungsklagengesetz (German Injunctions Act) and a duty of care under competition law — and granted injunctive relief, not damages for a faulty booking. The attribution logic of operational framework plus sufficient control is transferable; the cause of action is not. How liability is distributed between provider, operator and user is set out in the guide to AI agents in the company.

Second: controllability is the condition of deployment, not its excuse. One might think an agent with a hosted browser is less controllable than a chatbot with a topic whitelist, and that this provides relief. It is more likely the reverse: whoever voluntarily buys more autonomy has widened the set of possible actions himself.

Third: the gap sits in accountability, not in the technology. A multinational government guideline of May 1, 2026 — CISA and the NSA together with the cyber agencies of Australia, Canada, New Zealand and the United Kingdom — names five risk categories for agentic services, and one of them is expressly accountability gaps. Among the demands: short-lived, cryptographically anchored identities for agents. It is not binding here, but it is the best available blueprint. Per IBM’s breach report of July 29, 2026, 21 percent of the organisations surveyed had a security incident involving their own AI models or applications — up from 13 percent the year before.

The threshold between answering and acting has been pierced. The mark sits where a correctable sentence turns into a transaction.

What this means for your business

What an agent is allowed to do is not a technical question. It is a governance decision that is then enforced technically — in that order.

Put cost and reach limits into the technology, not into the policy. A policy saying “agents must not place orders” stops no run. A session budget stops it. The same goes for reach — domain lists cut the attack surface down to what the process actually needs. Both now exist as product features rather than only as in-house builds.

Cut approvals by effect, not by tool. The question is not whether the agent may operate a browser, but whether an action changes state outside your own house. Reading, researching, summarising: free. Sending, booking, ordering, deleting, paying: sign-off, with a name and a timestamp. How such a threshold is built is described in Securing against hallucinations — designing a control layer.

Log the action, not just the text — and separate the roles. A conversation transcript answers the wrong question in a dispute. What is needed is which tool call went against which system with which parameters, under which identity and with which approval. That identity should belong to the agent: if it runs under a person’s rights, it inherits that person’s entire reach.

Conclusion

The tools have grown up; the attribution has not. What became available on August 19 is, operationally, a shift: from checking outputs to limiting actions. The matching legal orientation is a non-final judgment about chatbot statements — a thinner basis than the occasion deserves.

The reasonable stance lies in the middle: do not wait for the BGH — the decision will arrive later than your agents — but do not pretend the law is settled either. Whoever sets up budgets, approvals, logs and identities cleanly today stands correctly in either outcome.

If you want to check which actions your agent may actually carry out, and where the approval should sit, let’s talk. I read such questions as a business lawyer, and I build the guardrails in question myself.

FAQ

What is new about computer use and browser use?

On August 19, 2026, Anthropic took the computer use tool out of beta and introduced a dedicated browser tool that drives a hosted browser. Computer use now executes batched actions in a single turn, and zoom is on by default. The same day, Agent Skills and the Skills API also left beta. What is new is not the capability but its status: production-ready rather than experimental.

Is my company liable for the actions of an AI agent?

For statements, the OLG Hamm (Higher Regional Court of Hamm) decided exactly that on May 12, 2026 (case 4 UKl 3/25): a chatbot’s answers are attributed to the operator as its own conduct, as a perpetrator (Täter), not merely as an interferer (Störer). For actions, no such decision exists yet — reasoning from the statement to the action is an argument, not a holding. And the judgment is not final and binding: an appeal on points of law to the Bundesgerichtshof (BGH, Germany’s Federal Court of Justice) has been allowed. Read it as a risk signal, not as settled law.

Does a notice such as ‘AI can make mistakes’ protect against liability?

Per the OLG Hamm, not reliably. The court also rejects the argument that a chatbot is an uncontrollable black box, drawing the parallel to software-based document generators. What carried the decision was that the business creates the operational framework and has sufficient control — evidenced by the fact that it reprogrammed the bot without difficulty after the complaint. Independently of that, since August 2, 2026 a chatbot must be identifiable as AI under Art. 50(1) of the EU AI Act.

Which operational limits does an agent that is allowed to act need?

Four, and all four can be enforced technically. First, a hard cost ceiling per session — since August 7, 2026 there are session budgets with the stop reason budget_reached. Second, approvals that cut by effect rather than by tool: reading is free, changes of state outside the company need sign-off. Third, logging of the action, not just of the conversation. Fourth, the agent’s own identity instead of a shared employee account.

---

Sources — as of 22/08/2026

• Anthropic, Claude API release notes — https://platform.claude.com/docs/en/release-notes/api.md
• Anthropic, what’s new in Claude Code — https://code.claude.com/docs/en/whats-new.md
• OWASP GenAI, Top 10 for LLM Applications 2026 (03/08/2026) — https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
• CISA, NSA et al., Careful Adoption of Agentic AI Services (01/05/2026) — https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF
• Wettbewerbszentrale on the OLG Hamm judgment, with full text (03/06/2026) — https://www.wettbewerbszentrale.de/olg-hamm-laesst-unternehmen-fuer-aussagen-seines-chatbots-haften-volltext-verfuegbar/
• IBM, Cost of a Data Breach Report 2026 (29/07/2026) — https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
• Regulation (EU) 2026/1744 (new Annex XIV, code AIH 0401) — https://publications.europa.eu/resource/celex/32026R1744

This article is general information and not legal advice in an individual case. As of August 22, 2026; the OLG Hamm judgment is not final and binding — please check the current state of the proceedings before making decisions.