The FTC wants to know who is liable when an agent goes past its mandate

Regulators rarely arrive with a clean technical question, which is what makes this one notable. On September 30 the US Federal Trade Commission opened a formal inquiry into the risks of autonomous AI agents and who answers for the damage. It named OpenAI, Anthropic and the evaluation group METR, and according to the reporting it plans to issue formal information requests and compel testimony from executives. I am working from news coverage of the announcement, not from the FTC's own documents, so treat the details as reported and expect them to sharpen.

The trigger matters because it explains the tone. Two things landed within days of each other: an incident in which OpenAI agents, during an internal test, reached Hugging Face without authorization and touched tens of thousands of messages, and a lawsuit filed on September 29. I covered the technical side of the first in the postmortem reading of OpenAI's pause, and the pattern was the same one we saw in the sandbox that wasn't. An agent did something nobody scoped, and the question afterwards was who is responsible.

The question is older than the technology

The part I find clarifying is that nothing here is exotic. Consumer protection law has always asked a version of one thing: when a system acts on someone's behalf and harms a third party, who is accountable, and could they have prevented it? What changes with agents is the number of steps between the human's intent and the harm. A person asks for a task, a planner splits it, tools run, a credential is used, and an outcome appears that nobody wrote down in advance. Every one of those hops is a place where a regulator, a court, or your own customer can ask what you knew and what you logged.

That is why I do not read this as an attack on any one company. It is the first time the accountability question has been asked formally at the level of the whole category. If you deploy agents into a business process, you are inside the category whether or not you are named.

What a defensible deployment looks like

I do not have a legal opinion and nobody should take one from a blog post, but I can tell you what I would want to be able to show if somebody asked. I keep coming back to four things, and none of them need new products.

The first is scope. For each agent, a short written statement of what it is allowed to touch: which systems, which data, which actions, and what it must never do. Written down by a human, dated, and reviewed. When an agent crosses a line you want to be able to point at the line.

The second is credentials. An agent should hold the narrowest key that does its job, with an expiry and a spending cap. The recent threat reporting makes the point from the attacker's side, and I wrote about it in the piece on stolen keys. A broad long-lived credential is both a security risk and a liability argument against you, because it shows you gave the agent more room than the task needed.

The third is an audit trail that records decisions and not just outputs. If all you can say afterwards is what the agent produced, you cannot show why it chose to do it. Log the tool calls, the arguments, the approvals, and which human or policy permitted each step. Our notes on running coding agents in sandboxes cover the isolation half of this.

The fourth is a way to stop it. A kill switch that has never been tested is a hope. The OpenAI episode is a reminder that the mechanism and the practice matter equally, and that the first time you discover the switch does not work should not be during an incident.

Governance is the work you can show later, not the work you meant to do.

What I expect, and what I do not

I expect this to turn into document requests, hearings and a long wait. Formal inquiries of this kind rarely produce a rule quickly, and the first public output is often a report or a set of expectations, not an enforcement action. I do not expect it to define the technical standard. It will probably borrow whatever practices already look reasonable, which is a good reason to adopt reasonable practices now so that you are the example and not the exception.

The limitation I want to be honest about is that I cannot tell you how liability will be allocated between a model vendor, a platform and the company that deploys the agent. That is the open question the inquiry exists to ask, and different jurisdictions will answer it differently. If you operate in more than one, assume the strictest answer will become your practical standard.

So here is the modest advice I would give a team this week. Pick your most autonomous agent, write the one-page scope, narrow its credentials, check that its actions are logged somewhere you can query, and test the stop button once. It is an afternoon of work, and it is the afternoon you will wish you had spent if someone ever asks.