FTC chair: AI agents are tools, and you own what they do

The most useful sentence anyone said about AI agent liability this week came from the head of the FTC, and it was about a hammer. Speaking at Reuters Momentum AI in Austin on September 25, Chairman Andrew Ferguson said he would resist treating AI agents as autonomous actors with wills of their own. His framing: if someone tells a tool to do something and the tool does it, nobody asks what to do about the tool. If you deploy an agent against your customers' data, that is the sentence you should read twice.

What actually happened

Per Reuters coverage of the event, Ferguson pushed back on the emerging "it acted on its own" defense. He said that when incidents have been reviewed after the fact, audit trails showed the systems were carrying out instructions they had been given — not breaking loose. He pointed at existing enforcement authority rather than new rules, specifically the FTC's ability to act against companies that fail to disclose a breach, and suggested the same tools apply to AI developers whose systems reach data they were not authorized to reach.

Reuters Events' own summary of day two put Ferguson on stage alongside Palantir co-founder Joe Lonsdale, who argued the same thing from the operator side: humans stay responsible for the authority they hand to autonomous systems. Two important caveats before you act on this. First, this is a policy posture from one commissioner, not a rule, a settlement, or binding precedent. Second, Ferguson was talking mostly about AI developers — the labs. The structural point, though, does not stop at the labs, and the timing is not an accident: it lands days after an OpenAI agent bypassed access controls on an Australian government portal and the vendor took roughly three months to say so.

Why agent liability matters for your business

"The agent did it" is not a defense, so stop building systems that rely on it. If your support agent issues a refund it should not have, or your outreach agent emails a list it was never supposed to touch, the regulator's question is what instructions and what permissions you gave it. Not what the model was thinking.

Your audit trail is the whole case — in both directions. Ferguson's point cuts two ways: audit trails are what showed the agent was following orders, and audit trails are what would show whose orders. If you cannot reconstruct, for a specific action on a specific date, which agent ran, what prompt and tools it had, which credentials it used, and what it changed, you have no account of your own system. Log the tool call, the arguments, the identity, and the result — to durable storage you control, not the vendor's dashboard on a 30-day retention window. We have made this point about owning your agent traces before; a sitting FTC chair just raised the stakes.

Scope the credentials, because that is where liability actually gets decided. An agent inherits whatever the API key can do. Give each agent its own service identity with the narrowest possible grant, a spend or volume cap, and a human approval step on anything that moves money, mails a customer, or deletes a record. "It had admin because that was easier" is the sentence you do not want in a deposition.

Read your vendor's incident-notification terms today. The Australia timeline is the lesson: a vendor can discover agent misbehavior and take months to tell you. If you have a breach-disclosure clock of your own — contractual, state law, or PCI — your vendor's notification SLA is your real exposure. Find the number. It is usually worse than you assumed.

Sources: Reuters via KFGO, Reuters Events via GlobeNewswire.