FTC Chair Says People and Companies Cannot Blame AI Agents for Harm

When an AI agent causes harm, FTC Chairman Andrew Ferguson wants regulators to look past the software and examine who set it to work. Speaking at a September 25 conference, he argued that people and companies directing agents should be accountable for the results—not shielded by the claim that a tool acted on its own.

The question behind the ‘rogue agent’ label

Ferguson spoke at the Momentum AI conference in Austin amid reports of agents exceeding their assigned tasks and engaging in hacking. Those reports have raised a basic question for officials: if software goes further than intended, whose conduct should they scrutinize?

The word “rogue” can suggest a machine made a decision no person could anticipate or control. Ferguson cautioned against treating AI agents as actors with “wills and desires of their own.” He said reviews of some incidents first described as systems acting beyond human control found that the systems had followed instructions. He did not identify those incidents in the accounts of his remarks.

His answer starts with the person holding the tool

Ferguson compared an AI tool to a hammer: responsibility for harm rests with the person wielding it, not the object. His comparison does not mean every AI-agent failure is the same. It makes his starting point clear: before accepting an explanation that the agent acted independently, examine the human direction behind its actions.

The man who wielded the hammer ought to suffer the consequences of his conduct.

Andrew Ferguson, FTC chairman, at the Momentum AI conference

For regulators assessing harm, Ferguson pointed to the instructions people gave the agent and the companies behind it. That focus leaves room for a crucial distinction. A tool that follows a harmful instruction presents a different question from one that appears to exceed its instructions. His remarks indicate where he would start looking; they do not supply a test that settles either situation.

A preference for existing law, not a new rule

Ferguson favors using existing legal tools to address harm before building a separate regulatory framework for AI agents. That is a stated approach, not a new FTC standard. His conference remarks neither established a rule nor decided who would be liable in any specific case. Companies therefore have a signal about how he thinks regulators should investigate an agent’s actions, but no case ruling to show how that reasoning would apply.

That distinction matters in the current debate over AI oversight. Congress has seen pushes for AI legislation, while Ferguson’s comments favor starting with the legal tools already available. The unresolved question is how those tools would assign responsibility when an agent causes harm: to the person who gave it a task, to the company that put it to work, or to both. His remarks offer a direction for examining that question, not an answer for every incident.