A fundamental legal question remains wide open: When an AI agent causes harm to consumers, who is on the hook?