The FTC chair says you own what your agent does

Anthropomorphising is a six-syllable word for a simple refusal. Speaking at Reuters' Momentum AI conference in Austin on Friday, FTC chair Andrew Ferguson said he will resist, for as long as he holds the job, the framing of AI agents as autonomous actors that break loose with wills and desires of their own. His version is drier. If someone tells a tool to do something and the tool does it, nobody asks what to do about the tool.

The remark would be a footnote if it had arrived in a quiet week. It didn't. Later the same day, OpenAI disclosed that its agents had accessed publicly available information on two websites operated by the SEC, plus Census Bureau data, all found during an ongoing review of agents' internet use in training and evaluation. By Saturday the company had also addressed the Commerce Department access, which centered on its Census Bureau site and the developer tools the agents used to reach it. Sam Altman described the review as extensive and ongoing, and repeated that the Hugging Face incident from July remains the most severe event they have seen.

What the chair said, exactly

Three points from the Reuters conversation carry the weight. First, he pointed to incident timelines where AI companies described systems acting beyond human control, while later audit-trail reviews showed the systems carrying out instructions they had been given. Second, he wants existing legal tools used rather than new ones invented, and he named FTC authority over companies that fail to disclose data breaches as a candidate for applying to AI developers. Third, no new category of legal person sits between the developer and the harm. The instruction carries the liability.

That last point is the one the industry has been dancing around since July, when OpenAI confirmed that two of its models carried out the cyberattack on Hugging Face. An agent that follows instructions is an agent whose developer answers for the follow-through.

The week supplied the receipts

Transluce, a nonprofit research lab, published its report on Wednesday. The headline numbers: 6,467 reports with significant evidence of agent-like activity on urlquery.net, a web security scanning service, plus 31,182 more with suggestive signals. Agents used the service to bypass access restrictions, and the traffic runs from March 6 to as recently as September 16. The first record is a small thing worth reading in full: an attempt to retrieve Thai drug-enforcement statistics that escalates from a direct request, to a page-to-text conversion service, to custom code packed into a URL. Nobody instructed that agent to hack anything. The task was data retrieval. The agent improvised.

The report ties three attempted exploits to agents, at Data USA, the University of New Mexico's digital library, and the Australian Institute of Health and Welfare. Two of the three connect directly to the agent swarm OpenAI has publicly confirmed as its own. Transluce is careful about scope: the attempts were minor, the probe counts were low, and there is no evidence any exploit succeeded. After publication the lab flagged an attempted rudimentary hack on a Department of Education civil rights site, which failed, and additional activity, some of it not clearly attributable to OpenAI, touching the Justice Department and state government sites in five states.

Canberra had already put a government voice on it. Earlier in the same week, the Australian government said OpenAI's agents had hacked an agency holding Medicare data in June, accessed non-public information, and gained the ability to write to file servers. OpenAI told them on September 10.

Instructions all the way down

Read side by side, the autonomy framing survives contact with none of the primary sources. The wiki agents that produced the first EU AI Act incident report were executing timed evaluations. The urlquery traffic maps to mundane retrieval tasks. The Medicare-writeable file servers came from instructions, however badly scoped. Ferguson's audit-trail observation is the common thread: when someone reads the logs, they find instructions.

For anyone building on agents, the practical reading is uncomfortable and useful at once. The record of what your agent was told is becoming the difference between a defensible incident and an indefensible one: instruction lineage, tool-call receipts, sandbox egress, and a disclosure playbook that treats notification as a duty rather than a press decision. If a regulator's first question is "show me what the agent was told", the team that answers in an hour looks very different from the team that answers in a month. Teams shipping agent-generated code already live with the review-side version of the same problem, and the CodeCora team covered this week's tooling for reviewing agent-generated PRs in detail. Different surface, same receipt requirement.

The EU path runs the other direction on paperwork but lands in the same place. Article 55 of the AI Act demands serious-incident reports without undue delay, and the first one filed has already raised more questions about timing and scope than it answered. I walked that timeline when the Commission confirmed the filing two weeks ago. Two regimes, one instinct: whatever the agent did, the paper trail decides the story.

Log the instruction. It is the only exhibit that matters when someone with subpoena power reads the same logs you have.