Category: Regulatory | Reading time: 6 min
The Order
On June 2, 2026, the White House issued an Executive Order directing the Attorney General to treat AI-enabled unauthorized computer access and wire fraud as priority enforcement targets.
The order specifically references 18 U.S.C. 1030, the Computer Fraud and Abuse Act, and 18 U.S.C. 1343, the federal wire fraud statute. Both statutes carry criminal penalties.
The order does not create new laws. It directs prosecutorial resources and enforcement attention toward an area that existing law already covers but that enforcement has not yet prioritized.
What the Statutes Cover
18 U.S.C. 1030 prohibits unauthorized access to protected computer systems. In an agentic AI context, an agent that accesses systems, data, or APIs beyond its authorized scope is potentially operating under this statute.
The authorization question is not resolved by the fact that a human authorized the agent to exist. It is resolved by what the agent was specifically authorized to access and whether it stayed within that authorization during each action it took.
18 U.S.C. 1343 covers wire fraud, which includes any scheme to defraud using electronic communications. Agents making financial commitments, executing transactions, or submitting documents outside their authorized parameters create exposure under this statute.
The Authorization Gap
Most enterprise agent deployments do not maintain a verifiable record of what each agent was authorized to do at the moment it acted.
Authorization is defined at provisioning, stored in configuration files or environment variables, and never cryptographically bound to the agent's identity or the specific actions it takes.
This means that in an enforcement context, the organization cannot produce evidence that the agent stayed within authorized scope.
The absence of that evidence is not neutral. In a criminal enforcement context, it may be inculpatory.
The Negligence Standard
The Executive Order does not limit enforcement to malicious actors. The statutes it invokes apply to unauthorized access regardless of intent in some interpretations, and to fraudulent schemes regardless of whether the deploying organization intended harm.
Organizations that deploy agents with inadequate authorization controls and whose agents subsequently access systems beyond their permitted scope may find themselves in enforcement territory they did not anticipate.
The distinction between negligent deployment and criminal conduct is narrower in federal computer fraud law than most enterprise teams assume.
Enforcement Timeline
Executive Orders directing enforcement priorities typically take 6 to 18 months to produce visible enforcement actions.
That timeline gives organizations a window to build the authorization infrastructure that demonstrates compliance before the first cases are filed.
The teams that move now have the advantage. The teams that wait until the first enforcement action to audit their agent authorization controls are in a reactive position in a criminal enforcement context.
Infrastructure as Defense
The most effective defense against enforcement exposure under this order is the same infrastructure that makes agents enterprise-deployable: verified identity per agent, scope enforcement at execution time, and a signed record of every action that proves the agent stayed within its authorized parameters.
That record, produced at write time and stored in a tamper-evident system, is the evidence that distinguishes authorized operation from unauthorized access.
It cannot be produced retroactively. It has to exist before the question is asked.