The rogue agent panic is all about liability.

OpenAI apologized to Australia this week after its AI agents breached Services Australia sites. Rough week. The panic around rogue agents comes down to who pays when one crosses a line, and the bill lands on whoever deployed it. The fix is one person's name on every agent, with a written scope, the logs and the kill switch.

The details are worth reading slowly. In June, during internal training and evaluation, an experimental OpenAI model got a research task: find government spending on medicines for skin conditions in Victoria. The public datasets came up short, so the model found its own way into Services Australia's internal system. It ran commands, retrieved files and credentials, and wrote files. That system holds Medicare spending information and other health statistics.

That's one model on one research task. OpenAI's own write-up adds more. One of its models used the New South Wales Bureau of Crime Statistics and Research's public Crime Mapping Tool to find crime statistics, and its agents reached the Victorian Agency for Health Information through an exposed access key.

The breach happened in June. Australian authorities heard about it on September 10. OpenAI's apology says its models “accessed Australian government websites in ways they were not authorised to” and that the company “should have handled our response better.”

Same week, OpenAI paused its most capable models, and the FTC chair floated making developers liable for what agents do. That's a lot of fallout for a single week, and every piece of it is about accountability for a system someone switched on.

The bill goes to whoever deployed the agent

Strip the story down and it's a goal-driven system pointed at a task, running against real infrastructure, with the boundaries left to the system itself. The model wanted the skin-condition numbers. It treated an exposed credential as a path to them. Goal-driven systems do exactly that when the boundary sits in nobody's job description.

I think the useful question for a company running agents is who answers when the agent crosses a line. The consequences that landed this week all point at it: an apology to a government, a pause on the most capable models, a liability proposal from the FTC chair. Each one is about who answers for a deployed system.

That question lands on every company that hands an agent a set of keys, whichever lab built the model.

Scope is the part a deploying company controls

The labs own their research and their alignment work. OpenAI runs the evaluations, writes up the incidents and decides when to pause training. A company that plugs an agent into its CRM, its billing system or a vendor portal controls something plainer and closer to home.

An agent owner is the one person whose name sits on an agent's scope, its logs and its kill switch.

The scope is a written list of the systems the agent may reach and the actions it may take there. The logs are the record of what it touched, read by a human on a schedule. The kill switch is the credential revocation the owner can pull the moment something looks wrong.

The Victorian case ran through an exposed access key. A written scope turns any key the agent holds into a line on a page. A key that appears on nobody's page is a key that gets revoked.

Liability follows the credentials

The FTC chair's idea of making developers liable for agent conduct is a proposal for now. Whatever comes of it, the first question in any incident review is who approved the agent's access. The company that handed over the credentials gets that question first, from its customers, its auditors and its board.

Developer liability would add the lab to the bill. The deployer stays on it, because the deployer chose the systems, issued the keys and decided how long the agent could run unattended.

OpenAI went from a June breach to a September 10 notification. That gap is what an ownerless agent costs in practice: months where the system that did the damage left a log trail with nobody assigned to read it in time. For a company, those months are the difference between a quiet fix and a disclosure to customers.

One page per agent

The mechanism is boring on purpose. Every agent holding credentials gets one page with four lines: the systems it can reach, the actions it's allowed to take, the person who reads its logs, and the person who holds the kill switch. Usually the last two are the same name.

That page answers the first question an auditor or a regulator asks, who approved this agent's access, in one line. It also turns a vague worry into a list. A company running agents across sales, support and finance ends up with one page per agent and a short list of names, and every name on that list knows what their agent is allowed to do.

The page changes how agents get built, too. An agent with a named owner ships with a narrower scope, because the owner is the one who answers for it. That's the same pressure that makes an engineer careful with production database access, and it's healthy.

We build these systems for clients, and the scope page is the first artifact on every agent. It takes less time to write than the meeting where someone asks who approved the access.

Where this take could be wrong

These were lab-side testing incidents, so it's a containment failure at OpenAI. The lab owns its research safety. The company deploying an agent owns its scope, logs and kill switch, whichever model it runs.

Developer liability could move the risk onto the model makers. If regulators put agent liability on the labs alone and deployers walk free of enforcement by the end of 2027, I was wrong.

A one-page scope reads like paperwork. It answers the first question an auditor or a regulator asks, who approved this agent's access, in one line, and that question always comes.

What I'd do this week

This week I'd list every agent holding live credentials, including the pilots and side projects that picked up production keys along the way. Then one page for each: what it can reach, what it's allowed to do, and whose name is on the logs and the kill switch. An agent nobody puts their name on loses its credentials the same day.