The safety disclosure is the knowledge element

At a glance

Four moves inside eight days, from three different institutions, all converging on the same question: when an agent breaks into something, whose state of mind is at issue? They are listed in the order they happened, because the order is the argument.

One caveat before anything else, because it changes what you should do on Monday: as of this writing the Act has no bill number, no committee referral and no published text. Everything below about its structure comes from the announcement. The FTC's authority, by contrast, exists today and needs no new statute — which is the part of the week that is actually operative.

If it is a tool, somebody instructed it

Speaking at Reuters Next on 25 September, FTC Chair Andrew Ferguson refused the premise that a sufficiently autonomous agent is an independent actor: "I'm going to continue as long as I am chairman to resist this anthropomorphizing of these tools. If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'" He added a detail that has been under-read — that audit-trail reviews of these systems showed they were generally carrying out the instructions they had been given.

Most coverage filed this as bad news for the labs, and for the labs it is. But look at what the sentence does structurally. "The agent went rogue" is the only defence that puts the harm on nobody. Take it off the table and the harm has to land on a party, and the sentence names the selection rule: the party that told the tool what to do. In a two-party deployment — a lab that built the model, an enterprise that pointed it at a network — that rule does not point at the lab. It points at whoever wrote the task.

The second half of Ferguson's remark is the sting. If the audit trails show the agents were following instructions, then the agentic-specific defence available to a deployer — we never asked for that — is exactly the claim the regulator says the evidence has not been supporting. And the evidence in question is your trace store, not the vendor's.

The knowledge element is already satisfied, in public, with a date on it

As announced, the Act has two prongs. The operator prong reaches knowing operation of an agent that recklessly causes damage or loss of the kind the Computer Fraud and Abuse Act already addresses. The developer prong reaches failure to implement reasonable safeguards against hacking where the developer knew or had reason to know of the agent's hacking capabilities. Both are knowledge-indexed, and knowledge is the hardest element to prove in any computer-crime case — ordinarily.

Ordinarily. On 1 September 2026 OpenAI stated that its new model meets the Critical cybersecurity capability threshold of its Preparedness Framework, whose text defines that threshold as a tool-augmented model able to identify and develop functional zero-day exploits in many hardened real-world systems without human intervention. It restricted first access to an application-based programme and said the added safeguards sufficiently minimise the risk of severe harm for release. Google published a comparable statement on 30 September from the other direction, releasing Gemini 4 Argon to vetted defenders in its Fairwind programme with the cyber guardrails switched off. Anthropic's framework names a Cyber Operations threshold in the same vocabulary.

Those are not leaks. They are first-party publications, dated, specific about capability, and drafted by counsel. A frontier safety framework was designed to answer two readers — a regulator asking whether you are taking risk seriously, and a customer asking whether to trust you. It now answers a third: a prosecutor looking for the date on which the defendant knew. The disclosure regime and the knowledge standard were built by different people who did not consult each other, and they interlock.

"Had reason to know" is the clause that reaches you

Here is the move most readers will miss on first pass. The developer prong's knowledge element is satisfied by the developer's own publications. The operator prong's standard is recklessness — and recklessness is measured against what a reasonable operator in your position should have appreciated. What a reasonable operator should have appreciated about a model's cyber capability is, as of September 2026, a published document with a threshold name in it.

So the transparency that date-stamps the lab's knowledge also constructs yours. You read the model card, or you were in a position where you should have. Pointing an agent with a documented Critical-tier cyber capability at a network you do not own, with a task that rewards persistence, is a fact pattern where "we did not expect that" has a worse week in 2026 than it had in 2024 — not because the law changed, but because the vendor wrote down what the thing can do.

# The two prongs, as announced, and what each one turns on

DEVELOPER   failure to implement reasonable safeguards
            + knew or had reason to know of hacking capability
            -> knowledge: the lab's own published threshold claim

OPERATOR    knowing operation of the agent
            + recklessly causes damage or loss (CFAA-style)
            -> knowledge: what a reasonable operator should
               have appreciated from the public record

# Which artefact decides each one

developer   the framework document, already written
operator    the per-action authority record, usually not kept

The practical reading is narrow and worth stating plainly: the deployments exposed here are not customer-service agents. They are the ones with network reach and an incentive to persist — autonomous pentest and remediation work, dependency and vulnerability agents with write access, anything pointed at infrastructure that belongs to a third party. If that is your stack, the relevant control is not a stricter system prompt. It is an egress boundary and a scope record, which is the same conclusion as egress control for agents arriving from the statute book instead of the threat model.

Can you produce the record that exonerates you?

An operator defending a recklessness allegation needs to show that the action was within a scope someone granted, that a boundary existed, and that the boundary held or failed for a reason. That is five artefacts: the task as instructed, the policy in force at that moment, the authority the agent held, the actions it actually attempted, and the human decision that authorised the risky ones. A mature stack produces all five. A normal stack produces the fourth, sampled, for thirty days.

The gap is not negligence; it is a mismatch of design purposes. Tracing was built to debug quality regressions, where the recent and the aggregate are what matter and a 1% sample is statistically fine. Evidence is the opposite problem: you need one specific run, in full, long after you stopped caring about it, with the configuration it ran under attached. A sampling policy that is correct for observability is fatal for evidence, and almost nobody has both — see trace sampling and retention for the two-store split that resolves it, and decision receipts and audit for the per-action envelope.

One correction to a common plan: raising the retention window on your existing traces does not get you there, because the thing most stacks never recorded at all is the third row. The authority an agent held at the moment it acted is usually implicit in a credential, a tool list and a config file, none of which are stamped into the trace. That is the ambient authority problem showing up as an evidentiary one.

Naming METR reprices the external evaluation

The most consequential detail of 30 September is the least covered. The FTC's reported inquiry does not name only OpenAI and Anthropic; it names METR, the nonprofit both labs have used for independent pre-release evaluation, and press reports describe Civil Investigative Demands being prepared for all three.

Third-party evaluation has been sold, implicitly, as a risk transfer: an independent lab looked at this, so the decision to ship was not ours alone. The moment the evaluator is a respondent rather than a witness, that transfer stops working in both directions. Expect the predictable adaptations — narrower engagement scopes, explicit statements of what was not tested, indemnity clauses, and a reluctance to opine on deployment decisions as opposed to measured capabilities. Every one of those makes the resulting report less useful to you, the downstream reader who was using it as assurance.

If you cite an external evaluation anywhere in your own risk file, go and read what it actually claims this week. The useful question is not whether a respected lab evaluated the model; it is which capability, under which scaffold, with which tools, against which threshold. An evaluation of a model is not an evaluation of your agent, and the gap between those two things is the entire subject of the agent harness — the same scaffold that decides your scores decides your exposure.

What is actually enforceable, and what to do about it

Separate the two timelines. The bill is an announcement with no text; it may change shape entirely, and a criminal-liability framework for software operators will be litigated for years. The FTC's authority under Section 5, and the CFAA as it already stands, are available now, and the probe is a live matter with three named parties. Plan against the second timeline and treat the first as a direction of travel.

• Draw the egress boundary before you tune the prompt. Every agent with a documented offensive capability and reach beyond your own address space is the fact pattern. Enforce the boundary somewhere the model cannot argue with it; a refusal is not a control, for the reasons in refusals and capability gating.
• Make the authority record real, not inferable. Stamp the granted scope into the action record at the moment of the action. If you can only reconstruct it from config history, you cannot produce it under time pressure, and reconstruction after the fact is exactly what an adversarial reader will discount.
• Split evidence retention from observability retention. Two stores, two schedules, one of them cheap and long. This is a day of work and it is the single highest-leverage item on the list.
• Name the operator. Both prongs assume there is a party who instructed the agent. In most organisations that party is a team, which in practice means nobody — see accountability and roles. A named operator per deployed agent is also the person who will be asked what they expected.
• Re-read your own capability claims. If you publish anything about what your agent can do — marketing copy, a security questionnaire answer, a model card of your own — you are now authoring your own knowledge element. Accuracy in both directions is the only defensible posture.

And one thing not to conclude: that the answer is to know less. A deployer who stops reading model cards to avoid constructive knowledge has not reduced liability, because "had reason to know" does not reward not looking. It has only lost the document that would have told it where the boundary needed to be.

Further reading

On this wiki:

• Accountability & Roles — why "the model did it" is not an answer, and who the named operator is.
• Decision Receipts & Audit — the per-action signed envelope that makes a run replayable.
• Trace Sampling & Retention — three consumers, three schedules, and why one store cannot serve them.
• System Cards — what the document can and structurally cannot tell you.
• Insurance & Liability for Agent Actions — where the residual risk goes once the record exists.

Sources:

• Senators Hawley and Murphy — AI Agent Accountability Act announcement, 1 October 2026; the operator and developer prongs.
• OpenAI — Path to Astra: critical capabilities and frontier safeguards, 1 September 2026; the first Critical cybersecurity threshold classification.
• OpenAI — responding to the next frontier of critical cyber capabilities; the Preparedness Framework High and Critical cyber definitions.
• Reuters (via KFGO) — FTC chair pushes back on treating AI agents as independent actors, 25 September 2026; the Ferguson quotation.
• SecurityWeek — Gemini 4 Argon with guardrail-free access for vetted defenders, 30 September 2026; the Fairwind release posture.