The semantic difference between an agent "going rogue", and a script that generates random valid curl requests is essentially pointless in the eyes of the law and responsibility.

From a technical standpoint, the difference is scale and intent, but ultimately people and/or and organization are culpable for the output.