Hook
On the first business day of January 2026, California's SB 53 became enforceable. The statute caps penalties at one million dollars per violation and obliges frontier developers to disclose training data, publish a safety framework, and file risk assessments. In roughly the same window, the Department of Justice narrowed federal scrutiny of AI misconduct to models "created with criminal intent" — a threshold that, as a practical matter, is close to unprovable. Read together, the two signals describe something stranger than deregulation: a jurisdiction that has declined to build an accountability layer while fifty legislatures improvise their own. Consider a concrete case. An autonomous agent plans across six steps, calls four external APIs, signs a transaction, and moves funds it was never authorized to move. Whose intent goes on trial — the developer who shipped the weights, the deployer who wired the keys, or the user who typed the prompt? Today, the honest answer is none of them cleanly.
Context
The statute at the center of this is older than the commercial internet. The Computer Fraud and Abuse Act was drafted in 1986, and it turns on two mental states: "knowingly" and "intentionally." Autonomous agents do not produce behavior in that shape. They plan across multiple steps, chain tool calls, emit probabilistic outputs, and execute against external APIs whose responses they cannot fully anticipate. Responsibility is also split three ways — developer, deployer, end user — and intent, as a legal object, has no fixed address in that triangle.
FBI Director Kash Patel's formulation, restricting scrutiny to models "created with criminal intent," pushes the bar to the moment of model creation. Model weights do not encode readable intent; circuit tracing and sparse autoencoders, whatever their research value, cannot carry a criminal standard of proof. The result is a federal posture that is hands-off not because the conduct is acceptable but because the evidentiary chain does not exist.
Into that vacuum step the states. California mandates disclosure, a safety framework, and risk assessment. Illinois requires annual independent third-party safety audits. Connecticut imposes bias testing and advance notification in hiring contexts. Colorado's algorithmic discrimination law is itself under challenge, with the DOJ intervening alongside xAI — which means enterprises now plan against laws that may not survive appeal. The rational corporate response is scenario-based compliance: build to the strictest state, operate to the loosest, document both. It is the most expensive configuration available.
The international comparison sharpens the point. Europe runs risk tiers with general-purpose obligations already live and high-risk duties arriving in August 2026. China pairs filing with content security. The UK and Singapore stay light-touch. American legal certainty is the lowest of the set — not because rules are absent, but because the rules are in litigation.
Core
Three technical primitives are missing, and no statute supplies them. Agent identity is unstandardized — there is no accepted identifier binding a running agent to a responsible legal entity. Behavioral logging is voluntary — no retention obligation, no format, no custody rule. Behavioral reproducibility is absent — silent model updates mean an agent that behaved one way in March may behave differently in June, and the March conduct cannot be reconstructed from the June weights. Enforcement without these is theater.
This is a cryptographic problem before it is a legal one, and the primitives already exist. Signed tool-call traces, weight hashing with version freezes, hardware attestation of the runtime, and registries mapping agent identity to a deployer's public key — all buildable today. Based on my audit experience, I would put it more bluntly: in the post-FTX code reviews I ran, the failures that mattered were never hidden in clever logic. They were missing logs. A protocol that cannot prove what it did is not innocent; it is merely undocumented. Every token holds a story waiting to be mined — and the agent economy is about to learn that the story must be signed at the moment it happens, not reconstructed afterward by a lawyer.
The economics run in a direction most commentary misses. Federal abstention does not remove cost; it relocates cost from the public sector to contracts, insurance, audits, and state compliance departments. A single independent third-party audit, depending on scope and model size, plausibly runs between fifty thousand and five hundred thousand dollars. Annualized, that is a material burden for a company under ten million in revenue and close to rounding error above a billion. Compliance has economies of scale, and the current arrangement systematically favors incumbents.
Two markets are being born from the gap: AI governance tooling and AI liability insurance. Both are real, and both will price uncertainty rather than risk — a polite way of saying they will price defensively. The most valuable enterprise market for agents, financial services and healthcare and hiring, is also the most suppressed, because procurement in regulated sectors demands a compliance anchor, and a federal void supplies none. The soul of the chain is written in its holders; the soul of the agent economy will be written in its deployers, and those deployers currently have nothing to point at.
There is an asymmetry nobody has priced publicly. When liability is unclear, the party with the strongest contractual position assigns it downward. Model providers limit exposure through terms of service; deployers absorb it; small integrators and end users absorb it last. Open-source complicates this further, since the boundary between publisher, fine-tuner, and deployer is undefined under every state statute now in force. The narrative says we are debating who is responsible. The mechanics say we are deciding who is insured.
Contrarian
The intuitive reading of the DOJ posture is freedom. The contrarian reading is that a liability vacuum is a tax on adoption. Enterprise buyers do not purchase autonomy; they purchase defensibility. When no compliance anchor exists, procurement cycles lengthen, indemnification clauses harden, and deals quietly die in legal review. Deregulation that removes the standard of care removes the very thing that makes a purchase signable.
And the industry's attention is misallocated. We do not just trade assets; we curate narratives — and the narrative capital of the last two cycles went into inscribing tickers onto Bitcoin, which is a Rolls-Royce hauling gravel: an insult to the engine and a poor freight solution besides. Meanwhile the genuinely scarce primitive, verifiable agent attestation, sits unfunded. I have watched technical elegance without value capture before; IBC is the standing proof that being right is not the same as being compensated. The same mistake is available here, at higher stakes.
The final inversion is legal. Criminal statutes are the wrong instrument. "Knowingly" will not survive contact with a probabilistic planner. Civil negligence will — because negligence asks what a reasonable deployer would have done, and a reasonable deployer is precisely the entity that keeps signed logs, freezes versions, and scopes tool permissions. The standard of care is a product specification in disguise. Whoever writes it first governs the market before any legislature votes.
Takeaway
The next twelve months will decide whether agent attestation becomes an open schema or a vendor lock-in. The only public-goods mechanism I have seen actually clear its own bar, Optimism's RetroPGF, would be the natural sponsor of the former. So the question is not whether Washington will regulate autonomous agents. It is whether, when the first agent causes real damage, anyone can produce a signature proving what it did.