In the fine print of xAI's GrokBot terms of service there is a number that should stop us. If the agent causes harm, the company's financial liability is capped at "the greater of the fees paid or $100." Not a thousand. Not a percentage of the damage. One hundred dollars, or whatever you happened to pay. A short while earlier, Meta attached a third-party insurance policy to its Muse agent, with a per-claim ceiling of $500. And Apple, for its Siri AI, defaulted to the oldest move in the platform playbook: the risk belongs to you.
Three companies. Three philosophies. Three prices for the same question.
Who pays when the machine does what it was told — and the telling was wrong?
I have spent enough years inside systems that promised to remove human judgment to recognize the shape of this argument. It is not new. It is the oldest argument in my field, wearing a new coat.
The trigger for this round of soul-searching was a statement from Andrew Ferguson, chair of the US Federal Trade Commission, speaking at Reuters' Momentum AI event. His position was clean and uncomfortable: when an AI agent executes an instruction, the developer is the responsible party. The agent is not a person. It is a tool. And tools, in law, are extensions of the hand that holds them.
This is not a rule. Ferguson was careful to frame it as a signal — a direction, not a statute. There is no binding federal text that says "the developer of an autonomous agent shall bear liability for its acts." What exists instead is a patchwork: a forty-two-state attorney-general coalition quietly drafting its own framework, Connecticut's AI Liability Act taking effect on October 1, and an FTC already probing algorithmic personalization pricing across food delivery, ride-hailing, and airlines.
For the AI world, this landed as news. For those of us who spent the last decade arguing about who is responsible when a smart contract drains a treasury, it landed as déjà vu. We have already lived the first draft of this story. We watched a community insist that its code was law, then watched a series of collapses force it to admit that law needs custodians. Now the AI industry is walking into the same room and reaching for the same light switch, certain no one has been there before.
Let me draw the map precisely, because the details matter more than the drama.
The three models are not marketing variations. They are three distinct answers to the question of where, in a chain of delegation, responsibility finally rests.
Meta's Muse, with its third-party insurance and $500 per-claim ceiling, chooses something close to strict liability backstopped by a financial product. The developer — Meta — absorbs the risk, then transfers it to an insurer. It is a confession dressed as a feature: we know our agent will sometimes fail, and we have priced that failure.
xAI's GrokBot, with its total disclaimer and the $100-or-fees cap, is the pure autonomous-contractor model. The agent does things inside third-party apps — it logs in, operates, transacts — and when it goes wrong, the financial exposure is nominal. This is a bet. It is a bet that regulators will not reach back, and that consumer waivers will hold in court. Both of those bets are shakier than the terms of service suggest.
Apple's Siri AI, slotting into existing platform terms, takes the traditional path: the user assumes the risk. It relies on the inertia of contract law, on the decade-old assumption that a platform is a venue, not an actor. That assumption survived content moderation. It is far less certain to survive an agent that actually places an order, transfers money, or sends a legally binding message on your behalf.
Now here is the part the coverage keeps missing. Ferguson's "tool" doctrine does not exist in isolation. In the same enforcement climate, the FTC withdrew its case against Rytr, an AI writing tool — on the reasoning that the tool itself is not unlawful, and only a developer's concrete conduct can be. Read those two positions side by side and they pull in opposite directions. Ferguson says: the developer is responsible for what the instruction did. Rytr says: the tool is not the crime. The only way to reconcile them is the sentence that has been sitting, unaddressed, in the middle of the whole debate.
The developer is responsible for what the agent was told to do — but not for what it does on its own.
Say that out loud and you hear the problem. Where is the line between instructed behavior and emergent behavior? How do you prove, in a courtroom, which side of that line a particular action fell on?
This is not a philosophical question. It is an evidentiary one. And it is the exact question my field already spent years failing to answer.
Ferguson's argument rests on a technical premise he did not state: that the system's logs will show it was executing given instructions. The audit trail, in other words, will prove the causal chain. I want to be precise about why that premise is fragile, because I have built and broken systems like this.
For an audit trail to serve as legal evidence, it must satisfy three conditions simultaneously. It must be complete — no gaps. It must be tamper-evident — provably unaltered after the fact. And it must be fine-grained enough to distinguish between the developer's intent as encoded in the system prompt and the agent's own runtime decisions. That third condition is where almost every current agent framework quietly fails.
Most production agents run on something like a reason-act-observe loop. The developer sets a goal and a set of tools. The model, at runtime, composes those tools in ways the developer never explicitly enumerated. Picture an agent told to "resolve this customer's refund" that is given three permitted tools — read a record, evaluate a policy, issue a credit. Each tool is authorized. But in a long-horizon task, the agent may chain them into a fourth, unenumerated outcome: it issues a credit under a policy it misread, to an account it misidentified, at a scale nobody sanctioned. No ordinary log can tell you whether that was "the instruction" or "the emergence." The log records actions. It does not record authorship.
I learned the shape of this problem in 2017. I was a cryptographer working in Singapore, auditing the Parity wallet library before a critical release, and I found a reentrancy vulnerability in the multi-signature logic that could have drained more than $300 million in Ethereum. I did not exploit it. I disclosed it privately, and the core developers patched it — later than I would have liked, but safely.
What that episode taught me had nothing to do with reentrancy. It taught me that "the code is the law" is a comforting fiction. The code was ambiguous. The question of who was responsible — for writing it, for reviewing it, for delaying the patch — had no mechanical answer. Tracing the code back to the conscience required a human. It always does.
And here is where the AI liability debate becomes, whether it wants to or not, a crypto problem. The very infrastructure Ferguson's doctrine needs — verifiable, tamper-evident, replayable execution logs — is the thing blockchain builders have been trying to construct for a decade under a different name. We called it trustless computation. We called it verifiable off-chain execution. We argued about it in governance forums and shipped it in half-working pieces. Now a federal regulator needs it to enforce a doctrine he has not yet written into rule. The hole is the same hole. Only the claimant has changed.
It gets harder. The consumer agents in the news are single-actor systems — one model, one user, one task. The frontier is multi-agent: systems where an agent delegates to another agent, which calls a third, and the harm emerges from the interaction rather than any single step. In that world, how do you attribute the damage upstream? Which link in the chain of agents is the "developer"?
My field has a working, if imperfect, analogy: on-chain attribution. When funds flow through a mixer, through a bridge, through three protocol hops and a DAO treasury, attribution becomes a forensic exercise, not a legal formality. We built analytics to reconstruct those flows precisely because the naive answer — "the last address that touched it" — was obviously wrong. AI attribution will be the same. The naive answer — "the last model that acted" — will be obviously wrong, and it will take years of enforcement to discover that. The question nobody wants to ask is whether we will build the equivalent of chain analytics for agent behavior before the first major multi-agent liability case, or after. History suggests after.
Now look past the three corporate models to the instrument underneath one of them. Meta's $500 policy is not a footnote. It is the emergence of a new category: AI liability insurance.
I have watched a version of this story before. For years, decentralized finance treated insurance as a curiosity — a niche product for the paranoid. Then the exploits arrived, and coverage became a structural requirement. The coverage gap you see in a $500 ceiling is the same gap we saw in early DeFi cover: the policy backstops the ordinary failure and leaves the catastrophic one exposed. If an agent mispurchases a large-ticket item, misfiles a legal document, or transfers the wrong sum, the difference between $500 and the real loss does not disappear. It relocates — to the user, to the courts, or to nobody, which is the worst option.
The commercial logic here is quiet but decisive. If developer responsibility becomes the baseline, then insurance stops being a differentiator and becomes infrastructure. The companies that can underwrite agent risk will hold a structural advantage over those that cannot. And underwriting requires historical loss data that does not yet exist — which means the first movers are effectively buying the future of the market by running the risk today.
This is the second time in my life I have watched a financial product grow out of a philosophical admission of fallibility. In 2020, I contributed to the MakerDAO governance of the Dai stablecoin and wrote a whitepaper arguing that decentralized stablecoins should function as public goods rather than profit centers. We spent months arguing about the collateral basket, because we understood that a stablecoin is not a promise that nothing will fail. It is a designed answer to what happens when something does. An insurance policy on an AI agent is the same instrument in a younger market: an admission of failure, priced and funded in advance.
Every conversation I have seen about this topic stalls on the same philosophical knot. Do AI agents have agency? Are they actors or instruments? It is a genuinely interesting question, and it is a distraction.
Consider how my field answered its version of it. We spent the better part of a decade insisting that "code is law" — that the contract's execution was the final word, and that the humans who wrote it were merely authors. Then a series of collapses made the position untenable. When Terra and FTX fell in 2022, I retreated to a quiet apartment in Hanoi for three months and wrote a long essay arguing that the promise of "trustless" systems had become a shelter for the untrustworthy. The position I arrived at was not that code has agency. It was that the philosophical question was never the operative one. The operative question was always: what is the smallest unit of accountability you can actually verify?
Ask that of an AI agent and the debate sharpens immediately. It does not matter whether we call the agent a tool or a being. What matters is whether we can point to a verifiable, attributable, replayable record of what it did and why — and whether the manufacturer of that record is accountable for its integrity. Everything else is theology.
And here is the blind spot I keep returning to. The coverage treats this as a legal story with legal answers. But the binding constraint is not legal. It is infrastructural. You cannot enforce a liability doctrine that depends on evidence you lack the technology to produce. Ferguson's doctrine is not wrong so much as premature — it awaits a log it does not have.
There is a harder lesson buried here too, one that should trouble anyone who celebrates regulation as consumer protection. Compliance has a way of becoming a moat. The GDPR did not merely protect European data; it sorted the market into firms large enough to absorb compliance and firms that were not. A world where AI liability is real and expensive is a world where Meta and Apple thrive and a two-person agent startup cannot launch without underwriting it cannot afford. The state attorney-general coalition, the Connecticut statute, the FTC probes — these may protect consumers in the long run. In the near term they concentrate power, and the concentration is the story no one is telling as loudly as the protection.
There is one more absence worth naming, because it is mine to name. When an agent acts as you — signs, transacts, speaks in your stead — the boundary between the agent's identity and your own begins to blur. A liability regime that cannot distinguish an agent's action from a human's is a liability regime that cannot protect either. This is the quiet reason I spent 2026 designing a Human-First Proof of Personhood protocol with a small team of cryptographers: not because identity is a product, but because accountability is impossible without it. If we cannot prove who is behind an action, we cannot assign the action to anyone. The AI liability debate is, underneath, an identity debate, and almost no one on the regulatory side has noticed.
And the deepest absence of all: the consumer's side of the bargain. Ferguson's anti-anthropomorphism — "it is only a tool" — cuts both ways. If the agent is merely an instrument, then it cannot be trusted. Not with your money, not with your correspondence, not with your representation in the world. The doctrine that protects the developer from liability also quietly tells the user not to expect much. That is a strange foundation on which to build an economy of delegation.
The agents are coming whether or not the law is ready, and the law is not ready. What we have are three prices for trust — one hundred dollars, five hundred, and the open-ended cost borne by you — and a regulator's signal that he intends to move the responsibility to the developer. Between the signal and the rule lies a distance measured in infrastructure we have not built and standards we have not written.
We have been here before, in a different room of the same house. We promised trustless systems and then discovered we needed trusted stewards. We build bridges from the ashes of belief. Now we are promising autonomous agents and will discover we need attributable records. The technology will arrive. The question is whether we build it as an afterthought, in the shadow of litigation, or as the foundation of something we choose deliberately.
Listening to the silence between the blocks has taught me that the honest systems are the ones that say what they cannot do. The protocol must serve the human spirit. Governance is not a vote; it is a vigil. This one has barely begun.