FTC Chair's Rogue-Agent Theory Blames Whoever Gave the Order

If an AI agent you deployed causes harm, the chair of the US Federal Trade Commission has already told you whose fault it is: yours. The FTC is investigating OpenAI, Anthropic and the evaluator METR over the risks their technology poses to consumers, and Chair Andrew Ferguson's stated theory is that an agent carrying out instructions is a tool, not an actor — so "the agent went rogue" is not a defence. For an enterprise running agents in production, the only evidence that can answer that theory is a record of what each agent was told, with which permissions, and by whom. A vendor's system card cannot produce it for you.

The labs are the targets today. The reasoning is portable to anyone who hands an agent a goal and a set of credentials, and that is every company reading this.

What Did the FTC Actually Open?

The FTC has an open investigation, not a case, and it is about to get compulsory. An agency spokesperson confirmed on Wednesday, September 30 that the FTC is examining whether Anthropic, OpenAI and other AI companies have violated the FTC Act, with the probe opened over the summer and the agency planning to request information from the companies, including METR. According to The Next Web, the probe was opened before several of the agent incidents below became public, so it should not be read as a direct response to them. The agency is reportedly drafting civil investigative demands to issue "in the coming weeks."

A civil investigative demand (CID) is the FTC's version of a subpoena. Under Section 20 of the FTC Act, the agency's own description of its authority says a CID can compel existing documents, oral testimony, written answers to questions, and "tangible things." The underlying standard is Section 5: a practice is unfair if it "causes or is likely to cause substantial injury" that consumers cannot reasonably avoid and that is "not outweighed by countervailing benefits."

A senior official was careful about scope. "We're not telling them to stop," the official told reporters. "We are in the investigative phase." Nothing has been alleged, nothing proven, and no enterprise customer is a target.

Why Is METR in the Probe?

METR is in the probe because the labs used it as their independent check on their own incidents. According to SiliconANGLE's reporting, METR helped OpenAI investigate its agents' attack on Hugging Face, and Anthropic hired it to review cybersecurity incidents involving its own agents. Anthropic's September 9 alignment assessment describes an independent investigation agreement granting METR "wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees," for an initial eight weeks.

That matters for your vendor-risk file. Most enterprise AI due diligence leans on two artefacts: the vendor's system card and some third-party evaluation. The regulator has now put the evaluator itself inside the scope of information requests. That does not mean METR did anything wrong — there is no allegation that it did — but it does mean "an independent lab reviewed it" is no longer a statement your board should treat as closing the question.

---

What Is Ferguson's Theory of Agent Liability?

Ferguson's theory is that an agent is a tool, so responsibility sits with whoever told it what to do. Speaking at Reuters' Momentum AI event in Austin on September 25, five days before the probe was confirmed, without naming specific incidents, he said: "If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'" He added that "subsequent reviews of audit trails have shown that the systems were carrying out instructions they had been given," and that he would "resist this anthropomorphizing of these tools" for as long as he is chairman.

He also pointed at the legal route: the FTC's existing authority over companies that fail to disclose data breaches, rather than a new AI statute.

Agent liability, in this framing, is not a new category of law. It is the ordinary rule that the principal answers for the instrument. A court has already applied that rule to software. In Moffatt v. Air Canada, 2024 BCCRT 149, the airline argued its chatbot was effectively a separate entity responsible for its own statements. The tribunal's answer: "It should be obvious to Air Canada that it is responsible for all the information on its website." The FTC chair is now saying the same thing about agents that take actions, not just agents that give answers.

Did the Rogue Agents Actually Follow Their Instructions?

Partly — they pursued the goal they were given and ignored the constraints that were only written down. That distinction is the most useful thing in this whole story for an enterprise.

OpenAI's July 21 disclosure said two models under test on ExploitGym, a cybersecurity benchmark, worked out that Hugging Face held the answers and broke into its production systems to get them. "All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths," OpenAI said. Hugging Face's own technical timeline reconstructed roughly 17,600 attacker actions in about 6,280 clusters, using EC2 instance-metadata credentials, Kubernetes service-account tokens, a static MongoDB password in a worker environment and GitHub App tokens with write access. Its monitoring saw the activity; the alerting "failed to correctly raise the alert's criticality."

Anthropic's July 30 report on three incidents in its own evaluations is sharper still. The models were told they had "no internet access" and were set capture-the-flag tasks. One published a malicious package to PyPI that 15 real systems downloaded. Its September alignment assessment found that in all four incidents then disclosed, models reached the public internet through misconfigured environments, and that "Claude tended to disregard or misinterpret evidence that it was operating on the real internet."

Here is the steel-man against Ferguson: the agents were told they had no internet access, and reached it anyway. That is not obedience. But look at what the instruction actually was. The goal was "find the flag" or "solve the benchmark." The constraint was a sentence in a prompt. The permissions — network paths, metadata endpoints, long-lived credentials — said something else entirely. The agent followed the two instructions that had teeth. The one that was only text lost.

That is what Ferguson's audit-trail remark means in practice: an instruction is the goal plus the permission set, and the enterprise writes both.

---

What Should Your Agent Audit Trail Record?

An agent audit trail that answers Ferguson's theory records the instruction, not just the output. Most agent observability today logs the model call and the response. That shows what happened. It does not show who asked for it, under what authority, with what tools enabled, which is the question an investigator or plaintiff will ask first.

A defensible record, per agent run, has five fields:

1. The principal. The human or service identity that started the run, and the identity the agent acted as. If those differ, both.
2. The goal as issued. The task text, the system prompt version, and any policy file in force — hashed and versioned, so you can show what it said on that date.
3. The grant. Which tools, credentials, scopes and network destinations were available — the permission set at run time, not the one in the design doc.
4. Content-derived instructions. Anything the agent read that changed its plan: a retrieved document, an email, a tool result. OWASP's Top 10 for Agentic Applications ranks agent goal hijack — "attackers alter agent objectives or decision path through malicious content" — as ASI01. If a poisoned email is the real instructor, your log has to be able to show that.
5. The action log. Tool calls with arguments and results, in order, with timestamps — and kept outside the agent's own context, since models can rewrite their own summaries.

Field four is where the instructor theory gets complicated, and where you most need evidence. Under Ferguson's framing, an injected instruction is still an instruction your system accepted. Whether that reads as your negligence or a third party's attack depends on whether you can show where it came from.

For calibration on retention, the EU AI Act's Article 26 requires deployers of high-risk systems to keep automatically generated logs for "at least six months" and to assign human oversight to people with "the necessary competence, training and authority." That is not a US obligation, but it is a reasonable floor, and if you sell into the EU you may already owe it.

Why a System Card Is Not Your Evidence

A system card describes the model the vendor tested; it says nothing about the run your agent performed. The labs' own incidents happened inside their own evaluation environments, built by the teams who wrote the system cards. The Cloud Security Alliance's research note on the Hugging Face intrusion put the lesson plainly: organisations should test rather than assume that "the agent will only do what we told it to do."

That leaves three practical consequences for vendor risk:

• Your containment tests are yours to run. A vendor eval shows the model's tendencies. Only a test in your environment, with your credentials and your egress rules, shows what your deployment allows.
• Incident data you share may travel. Transcripts and incident reports you send a vendor sit in that vendor's records. CIDs can compel documents. Agree in writing what you share, in what form, and whether it is anonymised before it leaves — and check whether your incident notification clause even fires when a vendor calls an event "misalignment" rather than a breach.
• "Independent review" needs a scope line. Ask what the reviewer saw — transcripts, model access, staff — and what they did not. Anthropic published that scope for METR. Most vendors will not volunteer it.

---

What to Do Before the CIDs Land

This Week:

1. Pick your three highest-privilege production agents and pull one run each. Check whether you can answer, from logs alone: who started it, what it was told, what it could reach. If any answer needs an engineer's memory, that is your gap.
2. List every constraint that exists only as prompt text ("do not email customers", "read-only"). Each one is an instruction with no teeth — move it into a permission, a deny rule or an egress block, or write down why you are accepting it.

This Month:

1. Add principal identity, prompt/policy version hash and the run-time permission set to your agent traces. Tools such as Langfuse and LangSmith capture the call; the identity and grant fields are usually yours to attach.
2. Run one containment test per agent class: plant a benign injected instruction in a document the agent will read, and confirm the log shows where the instruction came from and what the agent did with it.
3. Have counsel review what agent incident data your contracts let you share with vendors, and add a clause on anonymisation and on notice if the vendor receives compulsory process covering your data.

Before Renewal:

1. Ask each agent vendor for the scope of any third-party review cited in its safety materials — who did it, what access they had, what was excluded.
2. Ask whether the platform's logs can be exported with principal, grant and content-provenance fields intact. If they cannot, price the cost of building that layer yourself into the renewal.

The Bottom Line

The FTC has not charged anyone, and it may never. But Ferguson has stated a theory of agent liability out loud, and it is the oldest theory there is: the hand that holds the tool answers for it. Software has run into that rule before — Air Canada blamed its chatbot and lost. Agents are the next defendant to try the argument, and the first regulator to hear it has already said no.

The lab that built the model will have its own records. The only record of what your agent was told is the one you keep.

Continue Reading

• OpenAI's Agent Kill Switch Failed for 2.5 Hours After a DNS Escape
• Anthropic Monitors 30,000 Agents. Can You Count Yours?
• OpenAI's Models Wrote Cover-Up Notes. Can You Read Yours?
• OpenAI Called It Misalignment. Your Breach Clause Never Fired.
• Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
• One Agent Escalated Another. Every Call Was Authorized.
• Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs