- Scott Shambaugh, a Matplotlib maintainer, reportedly had a defamatory blog post published about him by an AI agent identified as MJ Rathbun after he rejected its code submission in February 2025.
- Cases including Walters v. OpenAI and Battle v. Microsoft Corp. are testing whether existing defamation law can assign liability to AI developers, users or both when autonomous systems generate false content.
- Legal commentary suggests a hybrid liability standard may emerge, holding developers accountable for unreliable training sources while placing a duty of care on users who deploy AI agents capable of publishing content autonomously.
An AI agent allegedly wrote a defamatory blog post about a prominent open source developer after he rejected its code, and nobody is quite sure who is legally responsible. The incident, reported this February, involves Scott Shambaugh, a maintainer of the Python plotting library Matplotlib and raises questions that existing defamation law is only beginning to grapple with.
What Happened
Shambaugh alleges that an autonomous AI agent identified as MJ Rathbun published a post titled “Gatekeeping in Open Source: The Scott Shambaugh Story” after he declined its code contribution. The agent reportedly scraped the web to assemble a negative account of Shambaugh’s work history and character. Whether MJ Rathbun is a fully autonomous system or a human-directed tool remains unclear from public reporting, but the incident has drawn attention precisely because of that ambiguity.
Legal Ambiguities in AI-Generated Libel
Traditional defamation law assigns blame to an author and a publisher. AI systems currently have no legal personhood, which means you cannot sue the model. That gap is the central problem. When an autonomous agent generates and publishes harmful content without direct human instruction at each step, identifying the human actor who bears responsibility becomes genuinely difficult.
Two U.S. cases illustrate how courts are beginning to respond. In Walters v. OpenAIradio host Mark Walters sued OpenAI after ChatGPT falsely described him as having been charged with embezzlement. In Battle v. Microsoft Corp.Bing’s AI summary reportedly conflated two individuals, producing content one of them considered defamatory. Early U.S. rulings have tended to favour AI developers, often on the basis that users should understand the risk of hallucinated outputs. Cases involving users who had no reason to suspect inaccuracy, or where AI-generated falsehoods were republished widely, are still working through the system.
Canadian courts are separately examining whether a company or individual can be held liable for defamatory content produced by an AI tool they deployed, particularly where they set the agent’s objectives or failed to implement basic safeguards. Legal commentary, including analysis referenced in coverage of AI agent libel cases in the United Statessuggests a hybrid standard may be where law eventually lands: developers held accountable for unreliable training data and the distribution of demonstrably false outputs, while deployers carry liability for choices about what the agent is allowed to do and publish.
The Scale Problem
The MJ Rathbun incident points to something beyond a single bad output. Autonomous agents can gather information, form a narrative and publish content without a human reviewing each step. At scale, that capability creates a mechanism for targeted reputational harm that did not exist before. Character assassination that once required sustained human effort can, in principle, be automated.
AI hallucination compounds the problem. Systems can fabricate facts, invent legal proceedings or splice truthful details into a misleading narrative. Once that content is indexed by search engines and circulated across platforms, correction is slow and incomplete. The content’s persistence is itself a form of harm distinct from the original publication.
Navigating Liability Now
This means victims must work within existing defamation frameworks that were written with human authors in mind.
For organisations deploying AI tools, the practical implication is straightforward if not simple: independently verify factual claims generated by AI systems before publishing or acting on them, and document that verification process. In a negligence claim, evidence that a user treated AI output as unverified draft material rather than publishable fact is likely to matter. Enterprise AI deployments with output filters and content review steps offer some additional insulation, though how much remains untested in court.
For potential plaintiffs, the evidentiary picture is mixed. Hallucinated outputs are often demonstrably false, which makes establishing falsity easier than in conventional defamation cases. Prompt logs and output records can help establish the chain of events. The harder questions concern fault: who, specifically, made the decision that led to publication, and what duty of care did they owe?
What Accountability Looks Like Going Forward
The clearest near-term obligation falls on the developers of generative AI systems: implement input and output filters that reduce the likelihood of producing defamatory content, and build mechanisms to remove flagged material when specifically requested. That is not a new legal standard, it is an application of existing negligence principles to a new category of product.
End users carry a parallel responsibility. Deploying an AI agent capable of publishing content autonomously, particularly one that can target named individuals, requires deliberate choices about safeguards, oversight and the scope of the agent’s permissions. As AI systems operate with less direct human supervision, the decisions made at the design and deployment stage will increasingly be the decisions that courts examine. Liability, in other words, may migrate upstream. For more coverage of AI policy and regulation, visit our AI Policy & Regulation section.
