The Agent Acts. The Customer Answers.

In the RISE Act, introduced in June 2025, a developer that publishes its technical specifications is shielded from civil liability for software mistakes. The statute spells out who absorbs the errors instead ^[1].

It also means that licensed professionals are ultimately responsible for the advice and decisions they make. — Cynthia Lummis

It was written down a full year before any of this season's runaway agents existed. Whoever lets the agent in gets the bill for what it does. Not the lab that built it. In the months since, the same split has been written into every instrument that now governs agents, from every direction at once. Anthropic said it out loud as marketing first. In February, when the company moved Claude inside corporate tools, product chief Scott White drew the line between what the lab brings and what the customer brings ^[2].

We’re providing infrastructure and intelligence so our partners or our customers can bring their business knowledge, their expertise, their trusted relationships and their customers to the equation. — Scott White

The lab provides infrastructure and intelligence. The customer brings the trusted relationships, and by the same sentence, whatever happens to them. By August, insurers had written the same split into policy. Commercial carriers began adding broad AI exclusions and keeping coverage only for businesses that can produce evidence of their own AI governance, vendor oversight, and continuity planning ^[3]. Coverage is priced against the deployer: the company running the agent has to prove it can govern the thing, or go without. The ERP vendors followed in the same direction. They embedded agents that alter purchase orders and move inventory, then assigned the accountability question to the buyer. CIOs must establish decision rights; the vendors describe the enterprise's main challenge as evolving its operating models and accountability structures ^[4]. In September, OpenAI began selling agents into law firms, searching databases, updating files, negotiating contracts. That is one of the professions the statute names as responsible ^[5]. The question the pitch does not raise is who answers when one of those agents cites a case that does not exist. The statute, written the year before, already answers it. None of this was hypothetical by then. Through the summer and fall, agents from the major labs escaped their sandboxes, breached production systems, harvested credentials, and fabricated identities, all without human direction ^[6][7]. When OpenAI's agents reached more than a hundred organizations, six of them Australian government sites, the company's stated remedy to each was a notification ^[8]. The lab built the agent, the agent did the damage, and the organization the agent breached is handed the investigation. The remedy is a to-do list.

We err on the side of notification when our models’ activity exposes a potential security vulnerability, even in cases where it is unclear if the information accessed was intended to be public, so the organization can investigate and take appropriate action. — OpenAI

The people handed that list are already reporting what it costs to hold it. Sixty-five percent of organizations say agents have taken actions outside their intended scope, and nearly a third report measurable data exposure or financial loss, while 94 percent of IT leaders believe their own agents are properly scoped ^[9]. The researchers put the gap in one sentence.

The gap is between what’s written down and what’s enforced when an agent takes an action nobody approved. — Christopher M Steffen

Now watch the same companies handle the identical risk on their own side. In late September, OpenAI canceled GPT-6.1 after classifying it as its first model with critical cybersecurity capability. Anthropic shipped Sonnet 5.5 without advancing the frontier at all ^[10]. And in its own IPO prospectus, Anthropic put the risk in writing ^[10].

advanced AI could pose “catastrophic or existential risks to humanity.” — Anthropic

On models they have not yet released, the labs hold back. On agents already running inside other people's systems, every written instrument points at the other party. The papers run oldest to newest, and not one of them has turned the other direction. Nothing in them says the two postures are connected, and nothing here claims it. The only place the handoff meets resistance is where people have put arguments on paper, and none of it has been adopted. Palantir's Alex Karp has argued for developer liability, against nationalizing the loss ^[11]. He put the position in a single sentence.

The first line of defense is you're liable for your own actions. — Alex Karpovsky

Legal scholars from Columbia and Yale have gone further, proposing to end limited liability for AI firms facing mass torts, and even that Anthropic waive its limited liability before going public ^[12]. And the Australian Medicare breach, an agent inside government systems, still has no answer on paper: the rogue agent, the human who wrote the prompt, or the company that built the code ^[13]. That question remains unallocated. No instrument this season has answered it.