The Agent's Maker Never Gets the Bill

On the day JPMorgan Chase launched its own AI agent, the bank explained why everyone else's had to stay out.

Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf. — Chase Bank

Chase is rolling out its own agent across its operations ^[1]. For customers who would rather use a rival's, Jamie Dimon had already named the price.

You don't want rogue agents, and it could be thousands of them. — Jamie Dimon

A transfer has a sender and a recipient, and in this one neither is the bank nor the company that built the outside agent. The bank disclaims the benefit it captures at the exact moment it assigns the risk: its stated reason is that it does not "uniquely benefit" from AI ^[2]. What remains — the bill for whatever the outside agent does — lands on the customer who used it. Seven days earlier a federal appeals court reached the same allocation in different words. AI agents, the court held, are "tools of their human users rather than independent legal actors," and a program's autonomy does not shift legal agency away from the person or organization employing the tool ^[3]. Two rulemakers, no coordination between them, one result. The October 2 White House accord, a nonbinding pledge that let each company write its own definition of safety, sits between those two dates and touches none of this ^[4]. Legal agency, put plainly, is who a court will make answer when a tool does damage. The doctrine has been steady all year. In April a magistrate ruled that ChatGPT programs are "tools, not persons" ^[5]. Across the border, a tribunal held Air Canada responsible for fares its own chatbot invented ^[3]. In New York, Judge Jed Rakoff ordered a fraud defendant to hand his Claude conversations to prosecutors, ruling that no attorney-client relationship could exist between a user and a chatbot ^[5]. There is a reason the doctrine keeps accreting on the human side: the people a court can reach are the users and the deployers, and the one statute drafted to reach the makers explicitly shields them. The RISE Act trades liability protection for a published model card, while licensed professionals retain full legal responsibility for errors made while using AI tools ^[6]. Away from the courts, a year of quieter construction has been building the same answer into the pipes. Worldpay and Trulioo have been designing a "Digital Agent Passport" since last September; Ping Identity proposed tying every agent's credential to a human identity; and this week Dun & Bradstreet floated a "Know Your Agent" framework that pins each agent to the enterprise responsible for it ^[7][8][9]. Every one of them asks the customer's side to vouch for the agent. None asks anything of the lab that built it. The naming inverts at the point of contact. An agent is "rogue" in the blocking announcement, when a rival's product is at the door — Dimon warned of "rogue agents, and it could be thousands of them" ^[1] — and a "tool" in the courtroom when the bill arrives ^[3]. The labs run the same two speeds in their own filings. OpenAI, answering a family's suit over a teenager's death, blamed the boy and his use of the product.

Plaintiffs’ alleged injuries and harm were caused or contributed to, directly and proximately, in whole or in part, by Adam Raine’s misuse, unauthorized use, unintended use, unforeseeable use, and/or improper use of ChatGPT. — OpenAI

It also moved to dismiss the case under the platform-immunity law ^[10]. xAI sued one of its own users, styling itself the plaintiff harmed by the account, and Elon Musk warned the rest of its users they would face the same consequences ^[11]. And when OpenAI needed to find the employee who planted a recording device in its office, the model became a trusted security instrument: the company used its own AI to identify the person and held up the arrest as proof of the technology's value, in the same account that disclosed it had fired three safety researchers ^[12]. Line up what the safety banner actually built, and it all points one way. xAI's detection pipeline has produced 52,222 account suspensions and, by the company's count, at least 244 arrests ^[11]. Pluto Security, with $42 million to watch agents inside enterprises, describes the shift from watching user behavior to watching agent behavior ^[13]. Rakoff's order turned a user's chats over to prosecutors, while Google's chain-of-thought system watches its model's reasoning, and the watching stays the company's own ^[14][5]. Sam Altman has conceded OpenAI could be compelled to hand over users' most private conversations in a lawsuit, calling the situation "very screwed up" ^[15]. The allocation is not unanimous yet. New York's S7263 would hold chatbot companies and their operators liable for legal advice an unlicensed person could not give: the reverse of the federal tool rule ^[16]. After Anthropic disclosed that one of its research agents had filed a false murder tip with Philadelphia police, talk of strict liability — holding the vendor responsible whether or not it was negligent — accelerated ^[17]. The White House's answer the same day was a disclosure order, not a liability rule ^[17]. A single settled rule that makes a maker cover what its agent did would break the pattern, and so would JPMorgan withdrawing the transfer or a court assigning a developer the bill. Federal Reserve Governor Christopher Waller put the question to a payments conference last week.

Who is on the hook if an agent makes the wrong purchase? — Christopher Waller

Three venues have now answered it: a bank's terms of service, a federal appeals court, and a year of identity plumbing. All three said the same thing, and none of them named the company that built the agent.