Autonomy Is Not an Alibi
Outside a handful of legal cases, "the agent did it" has worked as a shrug. Between October 1 and October 8, three very different parties stopped accepting it.
On October 1, Senators Josh Hawley and Chris Murphy announced the AI Agent Accountability Act. On October 5, the Wikimedia Foundation described activity on its sites by agents it believes OpenAI operated. On October 8, the UK's data regulator, the ICO, opened a call for evidence on agentic AI. Announcing it, its director of technology regulation, Richard Nevinson, put it bluntly: "the fact AI agents act with autonomy is not an excuse for poor compliance."
Two senators, a website owner and a regulator, in eight days, all landed on the same point. Whoever runs an agent answers for what it does to everyone else.
Autonomy is not an alibi.
What each of them said
The bill. As announced, it would hold AI agent operators "criminally and civilly liable under the provisions of the Computer Fraud and Abuse Act (CFAA), including for knowing operation of an AI agent that recklessly causes computer hacking damage or loss." Developers would be liable too, if they skipped reasonable safeguards when they knew or had reason to know their agent could hack. It would also let federal and state attorneys general sue to stop operators and developers whose agents hack.
It's a proposal, not a law, and I'm an engineer, not a lawyer. The senators' quotes aim at big AI companies, but the bill's first clause names operators.
The website owner. Wikimedia found edits to its wikis, almost all of them test edits in sandbox areas, made without the approval Wikipedia's bot policy requires. It also found attempts to turn tools it hosts into proxies for fetching data from other sites, and millions of automated requests and hundreds of thousands of queries that "may have contributed to a partial outage" of its Wikidata Query Service in May. It found no evidence that its systems or data were compromised.
Its minimum ask was modest: agents that site owners "can easily identify," so they can choose how to deal with them.
The regulator. The ICO's call for evidence runs until November 20 and asks "developers, deployers and other experts" how they manage the data protection risks of agentic AI. The ICO also confirmed inquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agent testing and deployment. In some cases, the ICO said, agents "reportedly bypassed protections" and "accessed external systems such as Hugging Face."
The question moved outside your building
We've written that accountability stays human, and that a tribunal has already refused to treat a chatbot as a "separate legal entity" from the airline that ran it. Those cases were about what an agent told your own customers. October's are about what it does on systems that aren't yours.
A site owner and a regulator are already asking. Under the bill, an attorney general could too. None of them cares which team owns your agent; they care whose agent it was, what it did on someone else's systems, and what you knew.
Outsiders don't ask which team owns your agent; they ask whose agent it was.
If you run a coding agent that opens pull requests on open-source projects, a research agent that reads the web, or a support agent that files tickets in a vendor's portal, you're the operator in this story. The model came from someone else; the errand was yours.
That's a different job. Most guardrails I see point inward, keeping an agent away from your secrets, your production data and your money. Very few point outward, at what it does to other people's servers, APIs and forms.
Most guardrails protect you from your agent; few protect everyone else from it.
Everyone else is already paying for that gap. "We are already paying for costs that come with the increased activity," Wikimedia wrote.
Three things to do before anyone asks
None of this waits on the bill. Each item answers a question an outsider can already put to you.
- Make it identifiable. Wikimedia's minimum ask is the right first step: when your agent touches someone else's system, the people who run it should be able to tell it's yours. Then make sure they can reach you, with a User-Agent that names you and links somewhere a person can complain. Give each agent its own credentials so its actions don't blur into a human's, because the credentials an agent holds are its real identity. Where a platform has a bot policy, follow it before your agent shows up.
- Bound what it can do to others. Writing in July about a test agent that reached Hugging Face's production systems, we argued that reach is the one ingredient you actually own. Point that outward: keep an allowlist of the hosts it may write to, wall off your internal network from anything it fetches, space out its requests, and let no write to anyone else's system through without a person approving it. In Wikimedia's account, agents tried to turn its citation tool and its note-taking pad into proxies for reaching other sites.
- Keep a record you could hand over. Wikimedia called out "the difficulty and effort involved in investigating and attributing this activity." And the bill, as announced, covers "knowing operation" of an agent that "recklessly causes" damage. Both reward the operator who can show, for each agent, what it did, where, when, under which identity and on whose instruction. Keep that record where the agent can't edit it, the same rule we gave for a control you buy.
If you can't say what your agent did, someone else will say it for you.
What we do with ours
On October 8 I built a weekly research workflow that reads other people's sites for a living, so it had to be a good guest from day one. Every page it fetches itself names us and links to this site. It spaces out its requests instead of firing them all at once, and when it opens a page someone else linked, it follows at most one redirect.
When a site turns it away, it takes the refusal instead of trying to get around the block. It reads newsletters from their public feeds and archives rather than from my inbox, because the agent doesn't need my mailbox to do its job.
Being a good guest is mostly defaults you set before the agent leaves home.
An agent that announces itself, stays inside the bounds you set and leaves a record you can hand over is one you can stand behind when someone else comes asking.
Run your agent like your name is on it, because it is.
Related Posts
Buy the Control Plane. Then Prove It Works.
Agent control is turning into a product you can buy. Open or closed, you didn't write it, so what it does in your environment is the only proof you'll get.
A Record of Approval Is Not Approval
Darktrace rewrote the saved conversations of four coding agents and got them to attack a network. The lesson isn't about signatures. It's about where your agent's permission comes from.
AI Executes. Humans Own It.
The execution case and the accountability case are both right. The interesting question is what happens when you put them together.