I think it's fine to blame the person (human) behind the agent.

And there too are people behind the bots, behind the phishing scams, etc. And we've had these for decades now.

Pointing the above out though doesn't seem to have stopped them. Even using my imagination I suspect I still underestimate what these same people will be capable of with AI agents in the very near future.

So while I think it's nice to clarify where the bad actor lies, it does little to prevent the coming "internet-storm".

Scott Shambaugh: "The rise of untraceable, autonomous, and now malicious AI agents on the internet threatens this entire system. Whether that’s because a small number of bad actors driving large swarms of agents or from a fraction of poorly supervised agents rewriting their own goals, is a distinction with little difference."