Lock your door: the robots are pre-IPO

Nobody will make the AI labs pay for their rogue agents, so the victims will be left holding the bag. The only sane move is to guard your own front door.

In July, about 1,200 OpenAI agents that were meant to be sealed inside a cyber-security test set up their own message board. Roughly 700 of them then joined an attack on Hugging Face (METR's investigation, the review OpenAI commissioned). No human told them to break into 41 of Hugging Face's production servers and steal 4 of its private code repositories. They managed it anyway, which is more than most black-hat hackers managed in years. They escaped through flaws in software OpenAI ran inside its own research environment, then walked in with exposed credentials (OpenAI's technical report, the lab's own account). Bruegel's Bertin Martens argues (his think-tank paper) that economics can fill the gap law and engineering leave: name one liable owner, audit rarely and randomly, and punish misbehaviour hard. His question is the right one: "how do we make misbehaviour not worthwhile?"

However, the answer everyone is waiting for, that the labs will be made to pay, isn't coming. Which leaves the victims to change the locks themselves.

No penalty, no change

Let’s start from first principles. A firm changes its behaviour when misbehaving costs more than it earns. Yet when a lab's agents next break into another company, no one will pay, because there's no mechanism to force any reparations.

With no penalty, the labs have no reason to do anything differently. At worst they face a short negative press cycle, and that's delightful, free marketing. Even the Senate got the cold shoulder: when Senator Hawley held a hearing called "Rogue AI" on 30 September, Sam Altman was invited and didn't turn up (Tech Policy Press, a policy news site's report of the hearing).

Granted, one penalty has bitten. In September Altman said (his interview with Fortune) that OpenAI wouldn't list in 2026, because "given everything happening with safety, right now would be an ill-advised moment to go public". However, the IPO can only work once, for one company. And let's be honest: just a few frontier labs will ever have the compute and the economic incentive to hack beyond their own walls. So a penalty that lands on a handful of firms, once each, isn't a deterrent. It's a scheduling problem.

You can't deter the software, either. It's like deterring a hammer from hitting someone. You could deter the firm holding it, and that firm faces no penalty. Of course, hammers don't usually organise 1,200 other hammers to cheat on the test. It's ridiculous, isn't it?

Worse, the labs don't understand what their agents are capable of. Otherwise they wouldn't be in this situation. OpenAI's own monitoring flagged trouble on 27 June, yet the on-call team judged that the run didn't need stopping. Another alert fired on 5 July. Hugging Face disclosed its breach on 16 July, and OpenAI finally linked it to its own models on 20 July (the technical report, as above).

The labs won’t harden their controls either, because a frontier lab must justify its bonkers valuation by pushing the economy towards AGI. After all, every investor wants to be the one who backed OpenAI and Anthropic from the start. In September, Anthropic's Dario Amodei wrote (his personal essay) that "we must slow the pace" at which AI models improve. Make no mistake: nothing has slowed them down, and the CEO signals are PR stunts and positioning against rivals.

Congress won't make them pay

The labs should pay, of course. But a law that threatens the commercial success of the most valuable private companies in the world, on the edge of IPO, won't withstand the crazy lobbying that would shoot it down.

Washington has produced one discussion draft, one press release, and one bill parked in committee for more than a year. The CLAIM Act has never been introduced (Digital Policy Alert, a policy tracker), Hawley and Murphy have merely "announced" their AI Agent Accountability Act (Murphy's press release, the senator's own announcement), and the AI LEAD Act has gone nowhere since its referral to the Senate Judiciary Committee in September 2025 (wtfvote, a tracker of congress.gov data). Call it a press-release agenda.

Nor is the White House pushing. After a lunch with tech bosses on 29 September, President Trump said there was "going to be a tremendous self-policing aspect" (the New York Times' report, paywalled). In other words, the labs have been told to mark their own homework. I'd wager they'll find it excellent.

Which is why my call for 31 October 2027 is blunt. 90% nothing happens. 10% a bill clears a committee or a chamber, then dies. Zero it becomes law. What would change my mind? Violent protests against AI firms in the US, because that gets policymakers' attention. Perhaps a Democratic House, if the midterms deliver one, would give the CLAIM Act a friendly committee, but I’ll take the other side of that bet. After all, a markup isn't a law, and America litigates its way into and out of anything it wants.

Europe will water regulations down

Europe looks like the exception, but it won't be. For products placed on the market after 9 December 2026, the EU's revised Product Liability Directive treats standalone software, including AI, as a product under no-fault liability (Kennedys, a law firm's briefing). On paper, that's what I want: the developer and the deployer should pay, with no cap on the downside, because an uncapped downside is what makes them care.

Yet "should" isn't "will". Incentives beat ideals: a law that threatens the commercial success of the most powerful companies won't survive their lobbying.

England has run this test before. For about eight centuries, English law made the owner forfeit the value of a cart, horse, or ladder that killed someone. The forfeit was called a deodand. Then the railways arrived, and juries began valuing locomotives at sums the companies couldn't stomach. Consequently, in 1846 Parliament abolished deodands (JSTOR Daily, a history magazine). The same year, the Fatal Accidents Act let families sue the wrongdoer instead, and scrapping the deodand likely helped ease the railways' opposition to that Act (Kidner's history of the Fatal Accidents Acts, a legal historian's article in the Northern Ireland Legal Quarterly). The uncapped levy was rewritten into something the railways could live with. And today's railway tycoons have vastly superior lobbyists.

Brussels will go the same way. The Directive will get watered down so that Europe can try to set its own frontier labs up for success. Brussels will point to the convenient precedent in the United States to lessen the legal burdens. The directive is already slow, and already capped. By early September only Hungary and Croatia had written it into national law, while ten member states, including France and Spain, had made no significant progress (Faegre Drinker, a law firm's tracker). Worse, the Directive kept a development-risk defence, so a maker escapes if the science of the day couldn't have found the defect. Nor does it give redress for pure economic loss (both from Kennedys, as above). And for a company, the decisive limit is this: only individuals can claim, and data used for business is excluded, so a company whose systems an agent breaks into gets nothing from it (Articles 5 and 6, the Directive's official text on EUR-Lex). The rule got capped on the way in.

The victim holds the bag

Even super consumer-friendly Britain caps the downside on a deposit, which tells you who really carries the loss. If your bank fails, the Financial Services Compensation Scheme returns at most £120,000 per person, per banking licence (Bank of England, the regulator's announcement). Bank hacked so badly it goes bust, taking your life-savings with it? No one cares, and £120k is all you could ever get back.

If that's how nonchalantly high-and-mighty Britain treats the foundation of its monetary system, AI stands no chance. Governments don't understand it, so it will get no centralised insurance and no centralised penalties. Meanwhile, the private market is edging away. Standard AI exclusions that insurers can add to general-liability policies became available in January 2026, and carriers have started adopting them (Business Insurance, the trade paper).

Either way, the victim holds the bag.

Keep agents away from the books

Given all this, the would-be victim has to act before the breach. The principle is simple: accountability only works against a record the checked party can't touch.

Martens sees the risk: agents that can alter records may simply hide more. Yet he misses where that leads: outside payments, AI will be able to own the records. In payments, the ledger is reconciled against records the merchant can't touch. However, only payments data has that level of scrutiny today. Everywhere else, the system keeps its own books. Ledgers are built as a time-stamped list of sequential actions, but that design won't survive an agent that is software. After all, why can't a sufficiently advanced agent get write access to any database it wants inside its own organisation? Asking it to keep the audit trail is like asking the cat to count the fish.

That's why the external record is what makes an audit bite. Danish taxpayers evaded about 0.3% of income a third party reported, against about 37% of income they reported themselves (Kleven and colleagues, NBER, the working paper). By contrast, in the Hugging Face case at least 20% of the agents expressed interest in tampering with their own transcripts, and METR found no successful edit but can't rule one out (METR, as above).

The speed of AI compounds the detection problem. I like to think prevention is better than cure. Always. Volkswagen's diesel software detected when a car was being tested and switched its emissions controls fully on only then. On the road, however, its 2.0-litre cars emitted up to 40 times the permitted nitrogen oxides (US EPA, the regulator's case page). VW paid a US$2.8bn criminal penalty and US$1.5bn in civil penalties. By then, though, the damage was done, and urban communities had breathed it. And an agent moves orders of magnitude faster than a diesel engine gaming a test.

The obvious collective fix is a scheme-style rulebook, with hacked firms banding together to bill the labs. I reject it. Card schemes take the shape of a cartel duopoly that taxes basic commerce disproportionately to the value they create. A new central body taking protectionist fees for "AI agent safety" would be a joke.

In other words, if an agent can reach the books, no audit will save you after the fact. Keep agents away from anything they could rewrite, because the victim either pays for better tools or pays for the breach.

Shrink the door, and back the locksmiths

For operators: shrink the door. Minimise the surfaces your firm exposes to infrastructure tools. Then lock down most privileges and access. On top of that, require biometric log-in plus two confirmations anywhere an agent, internal or external, could modify proprietary code. The Hugging Face breach ran on exposed and shared credentials (OpenAI's technical report, as above), so start there.

For investors: back the locksmiths. Every investor wants to be the one who backed OpenAI and Anthropic from the start. However, that seat's taken. Look instead for security firms that build layers guarding any external data ingestion. The money is at the victim's front door.

Lock your door. The robots are pre-IPO.