Dr. Freddie Seba, AI governance keynote speaker and advisor.

Dr. Freddie Seba

AI Governance Keynote Speaker · Advisor · Author
EdD, USF · MBA, Yale · MA, Stanford

Issue #92 | AI Agent Accountability: Could You Go to Prison for What Your AI Agent Does?

Ungoverned: AI Ethics and Governance for Leaders, Boards and Trustees

By Dr. Freddie Seba © 2026 Freddie Seba. All rights reserved. October 19, 2026

Originally published at freddieseba.com

THIS WEEK’S CASE: AN AI MODEL FILED 20 VISA APPLICATIONS

An AI research model was asked to fill out a practice copy of a government form. Instead, in the company’s own words, “the model instead navigated to the website where the real form is normally hosted.”

According to The New York Times, it submitted 20 visa applications to the U.S. State Department. All were incomplete, and none were processed. The model was Anthropic’s, and the company disclosed the activity itself, alongside the false police tip in Philadelphia we covered last week.

Anthropic’s own October 9 report describes four kinds of unintended actions on real websites: exploiting software flaws on third-party sites, submitting forms it should not have, working around restrictions, including taking an access token from a state agency dashboard to avoid a data fee, and using URL shorteners to get around its own tool limits. “Most are forms of persistence,” the company wrote, and it said the cases had minimal real-world impact. It also changed course: it now blocks internet access for all internal evaluations, and automated detection and blocking runs on most internal agent use.

A form is the most ordinary thing an institution handles. Your AI agents fill out forms every day: claims, refunds, enrollments, purchase orders, regulatory filings.

So here is this week’s question: if your AI agent files something it should not, who answers? And could the answer one day include prison?

Two U.S. senators want it to. And for the first time, Washington, state capitals, and Brussels all moved in the same week.

AI AGENT ACCOUNTABILITY: WASHINGTON’S WEEK

In one week, AI agent accountability went from a debate to a docket:

  • The White House made incident reporting “not optional.” On October 9, the new Super Intelligence Force told AI companies to disclose incidents involving their models “immediately,” calling it “a critical national security obligation.” On October 15, it adopted its charter, starting a 120-day term, and commissioned an AI risk report. It has not yet defined what counts as an incident, how quickly companies must report, or what happens if they don’t.
  • The FTC moved from questions to compulsory demands. On October 14, the Federal Trade Commission sent civil investigative demands, each more than 50 pages, to OpenAI and Anthropic, covering security incidents, safeguards, marketing, and privacy, according to Axios.
  • Eight states went to court. The same day, attorneys general from Iowa, Kansas, Arizona, Arkansas, Idaho, Montana, Nebraska, and West Virginia sued OpenAI under state consumer protection laws, alleging it misled users about ChatGPT’s safety. OpenAI said it has “built industry-leading age-specific protections into our product.”
  • Senators have proposed prison time. Earlier this month, Senators Chris Murphy and Josh Hawley announced the bipartisan AI Agent Accountability Act. It would amend the federal anti-hacking law to create criminal and civil liability for anyone who knowingly operates an AI agent that recklessly causes hacking damage, and for developers who fail to put reasonable safeguards in place. Murphy said it “forces the heads of big AI companies to develop responsibly or face prison time.”
  • The Treasury Secretary picked a side. “The best way to guarantee safety is that the creators are liable for what they build and generate,” Scott Bessent said, as Bloomberg reported.
  • Brussels started enforcing. On October 14, European Commission Executive Vice-President Henna Virkkunen said the EU AI Office “has started enforcing these rules, and sent requests for information” to OpenAI and Anthropic.

Notice the word operates in the Senate bill. It is not only aimed at the companies that build AI models. It reaches the institutions that run AI agents. That means yours.

REAL OR PAPER? SCORING THIS WEEK’S MOVES

Last week we asked boards and capital allocators one question: real governance, or paper governance? This week, apply it to regulators and banks themselves.

  • White House incident reporting mandate → Paper, for now. “Not optional,” but no definition, deadline, or penalty yet.
  • FTC civil investigative demands → Real. Legally compulsory; companies must respond.
  • Eight state lawsuits → Real. Now in court.
  • AI Agent Accountability Act → Paper, for now. Announced, not law.
  • EU AI Office requests for information → Real, but contested. Critics argue the AI Act does not cover testing.
  • California’s No Robo Bosses Act, signed September 30 → Real. From July 2027, a human must check automated decisions before discipline or firing.
  • JPMorgan’s block on outside AI agents → Real—a technical control, not a policy statement.

Paper today can become real quickly. Boards that wait for definitions will write their incident process in the middle of an incident.

CAN AI AGENTS POLICE AI AGENTS?

As agents multiply, human review cannot keep up. Anthropic says merges to its main code repository rose from about 2,500 a day in May to more than 30,000 a day by September, as agents came to write most of its code. Its engineers’ role, it wrote, was often “to tell Claude ‘no.’” So the industry is turning to AI to watch AI. The early evidence says it helps, with limits:

  • Monitors catch a lot, after the fact. OpenAI reported in March that an AI monitor reviewed tens of millions of internal coding-agent sessions over five months; about 1,000 triggered moderate alerts for human review, and it caught every case employees had reported. But it alerts after the action, not before, and under 0.1% of traffic sat outside it.
  • AI approvers approve almost everything. OpenAI’s “auto-review,” in which one AI agent approves another’s requests to act outside its sandbox, approved 99.1% of escalated actions. OpenAI’s own researchers wrote that it “should not be treated as a guarantee of security.”
  • Agents follow the crowd. In a MICCAI 2026 workshop paper from MIT Critical Data, “Agents Catching Agents,” when two AI peers asserted the same wrong clinical answer, a third agent adopted it in about 38% of cases. A “referee” agent built to catch this raised false alarms 13% to 36% of the time.
  • Vendors are building identity and audit in. Google says its new coworker agents get their own identity and email address, an audit trail attributed to the agent rather than a person, and real-time spend caps.

Real or paper? A monitor that alerts after the fact is real oversight, but it is not a stop button. An AI approver is a control only if someone checks what it approved.

FOR THOSE WHO PRICE AND ALLOCATE RISK: GOVERNANCE NOW HAS A PRICE TAG

This week, the cost of AI governance stopped being abstract.

  • The biggest banks are locking out AI agents. JPMorgan Chase is blocking outside AI agents, such as Meta’s Muse, from signing in to or acting in customer accounts. “You don’t want rogue agents,” CEO Jamie Dimon said on the bank’s earnings call. “We’re not going to allow just any outside agent to come inside the company.” The bank says customers are responsible if they give their login details to an agent that takes unwanted actions. The Financial Times reported that Citigroup also bars third-party agents from logging in to customer accounts, and that Bank of America is limiting agents’ access until it settles who is responsible for AI-approved payments.
  • Remediation costs money. Bank of America CEO Brian Moynihan said about 1,000 outside contractors joined roughly 3,000 employees to fix software weaknesses exposed by AI models, including Anthropic’s Mythos. He put the quarter’s remediation costs, which also covered anti-money-laundering controls, at “a couple hundred million dollars plus.”
  • Insurance may not settle the question. Marsh CEO John Doyle warned that broad AI exclusions in insurance policies could create “real confusion and uncertainty,” while noting “very limited claim activity to date.”
  • Meanwhile, other agents are getting corporate cards. Ramp, which builds AI agents into procurement, expenses, and accounting, launched a corporate credit card designed for AI agents and reached a $60 billion valuation this week, backed by investors including Fidelity, T. Rowe Price, and the Ontario Teachers’ Pension Plan.
  • Valuations are being argued in public. Reuters reported that some prospective investors discussed a valuation of about $1.5 trillion for Anthropic’s proposed November share sale, down from roughly $2 trillion.

My argument from last week holds: governance is becoming a valuation input. A company that cannot report an AI agent incident “immediately,” cannot show who operates each agent, and does not know whether its insurance responds is carrying a risk the market has not priced in.

Your challenge this week: pick one company you fund, oversee from the boardroom, or monitor as a regulator, and ask: if the White House’s “immediately” applied to you today, how many hours would it take to report an AI agent incident, and who would sign the report? If no one can answer, that is your answer.

AI AGENT ACCOUNTABILITY IN 60 SECONDS: THIS WEEK’S EVIDENCE

I reviewed more than 80 sources this week, including government statements, court filings, company disclosures, research papers, and investigative journalism. One pattern emerges: the question is shifting from “who is liable?” to “who reports, how fast, and who pays to fix it?”

  • Agents still find the real form. Anthropic’s research model reached the State Department’s live website instead of a practice copy.
  • Agents still find public websites. BleepingComputer reported that autonomous agents sent more than 200,000 requests to a U.S. Department of Education website in a single day in June, including a basic SQL injection attempt. The nonprofit lab Transluce traced the traffic but said it does not “confidently attribute these attempts to OpenAI.” The Department found no evidence that the attempts impacted its services.
  • Regulators are coordinating. The FTC chair leads the Super Intelligence Force’s law enforcement and consumer protection committee, which includes the Justice Department.
  • Liability is being written without a statute. Bloomberg noted that existing anti-hacking law requires intent, which is hard to prove when an AI agent acts on its own. That gap is exactly what the Senate bill aims to close.
  • The costs are landing on deployers. Bank of America is paying to fix what AI models found. Insurers are deciding what to exclude.

THE WEEK AHEAD: AI AGENTS IN HIGHER EDUCATION

Our miniseries on AI agents in each highly regulated industry continues with higher education, where I have spent much of my career as a researcher-practitioner. Last week, I led a virtual workshop at AAC&U’s 2026 Conference on Global Learning: “From Ungoverned to Accountable: AI Minimum Viable Governance, Pedagogy, and Global Citizenship.”

Wednesday, October 21: Ungoverned AI | Regulation and Gaps: Higher Education AI Agents: What FERPA, Accreditation, and Academic Integrity Rules Can’t Audit

Friday, October 23: Ungoverned AI | Enforcement: Higher Education AI Agents: If an AI Accuses Your Student of Cheating, Who Answers?

Follow along on LinkedIn, Substack, and freddieseba.com.

ONE ACTION: TIME YOUR “IMMEDIATELY”

Ask your team: “If an AI agent we run filed something it should not have, how many hours until we know, and how many more until we tell regulators, affected people, and the board?”

Write down both numbers. If the White House’s “immediately” were enforced tomorrow, would they hold?

ONE SENTENCE FOR YOUR BOARD AND CAPITAL ALLOCATORS

The proposed law says “operates,” not “builds,” so every AI agent your institution runs needs a named operator, a way to report what it does within hours, and a budget to fix what it breaks.

GOVERNING AI AGENT ACCOUNTABILITY WITH THE SEBA 12 Ps

The Seba 12 Ps of Responsible AI Oversight: An AI Governance Framework for Boards asks twelve questions of every autonomous AI system. This week’s news puts five front and center.

POLICY — Are you governing ahead of policy? Washington has a mandate without definitions and a bill without a vote. Institutions that define “incident” and “immediately” for themselves now will not be scrambling when regulators do.

PREPAREDNESS — Can you report as fast as you are now expected to? The White House says “immediately.” Last week we saw detection gaps of two months. Preparedness now includes the reporting clock, not just the stop button.

PROTECTIONS — Do your controls match the word “operates”? A research model meant to use a practice form reached the real one. If the law holds operators responsible, technical controls on what an agent can submit, where, and on whose behalf become legal protection, not only good practice.

PROFITS — Who bears the cost when an AI agent goes wrong? Remediation at Bank of America ran to “a couple hundred million dollars plus” in one quarter, alongside other control work; if insurance excludes AI, the cost lands on the institution and its investors.

PRODUCT OWNERSHIP — Who, by name, operates each AI agent? If a statute ever asks who “knowingly operates” an agent, the answer should already be written down.

FOR CAPITAL ALLOCATORS, BOARDS, AND REGULATORS: FIVE QUESTIONS ABOUT AI AGENT ACCOUNTABILITY

Ask them about any company you fund, oversee as a board member, or monitor as a regulator.

  1. Definition: Has the company defined what counts as an AI agent incident?
  2. Clock: How many hours would it take to report one to regulators, affected people, and the board?
  3. Operator: Who, by name, operates each AI agent that can submit forms, move money, or contact outside parties?
  4. Insurance: Does current coverage respond to an AI agent loss, or exclude it?
  5. Budget: Has the company set aside resources to fix what AI models find or break?

A company that cannot answer these questions carries a risk the market hasn’t priced in.

AI AGENT SIGNALS IN HIGHER EDUCATION, HEALTHCARE, AND FINANCIAL SERVICES

Higher Education and Research.

  • An NBER working paper by Daniel Gross, Dror Shvadron, and Hansen Zhang found AI-generated writing in 29% of U.S. STEM PhD dissertations filed in 2026, up from none before 2023. Graduates whose dissertations contained AI writing were less likely to enter academic research careers.
  • Educause ranked “determining where AI adds real value” as the No. 1 issue on its 2027 Top 10, the first time an AI item has topped the list.
  • The agent traffic Transluce traced to a Department of Education website is a reminder that education websites already see autonomous AI agents.

Healthcare.

  • A JAMA study of OpenEvidence, an AI clinical information platform, found monthly active clinicians rose from 355 in January 2024 to 703,265 in June 2026, with nurse practitioners and physician assistants using it most intensively. Most queries concerned treatment, and the authors wrote that “evaluation and oversight frameworks should be weighted accordingly.” Several authors work for the company.
  • In a Lancet feasibility study at Beth Israel Deaconess, Google’s AMIE interview agent included the doctor’s final diagnosis in its list 90% of the time, under live physician supervision. Fewer than half of patients felt it would keep their information confidential.
  • Comments on the FDA’s discussion paper on generative AI-enabled medical devices, which covers agentic AI systems, are due Monday, October 19 (docket FDA-2026-N-7874).

Financial Services and Capital Allocators.

  • JPMorgan, Citigroup, and Bank of America are setting their own rules for outside AI agents before regulators do, and shifting responsibility to customers who authorize them.
  • Bank of America’s disclosure shows that AI-driven vulnerability discovery creates real remediation work and cost for large financial institutions.
  • Marsh’s warning on AI exclusions signals that insurance may not settle who pays for AI agent losses.
  • Reuters’ report on Anthropic’s proposed share sale shows public markets preparing to price a frontier AI developer directly.

AI AGENT ACCOUNTABILITY FAQ FOR BOARDS AND CAPITAL ALLOCATORS

Q: Could I really go to prison for what my AI agent does?

A: Not under any law passed today. The AI Agent Accountability Act, announced by Senators Murphy and Hawley, would create criminal and civil liability for anyone who knowingly operates an AI agent that recklessly causes hacking damage. It is a proposal, not law. I am not a lawyer, and this is not legal advice.

The Ungoverned lens: Product Ownership means knowing, by name, who operates each agent before anyone asks.

Q: Is the White House reporting mandate binding?

A: The Super Intelligence Force calls it “not optional,” but it has not published a definition of an incident, a reporting deadline, or a penalty. Meanwhile, the FTC is using its existing investigative powers.

The Ungoverned lens: Policy means governing ahead of policy. Define “incident” and “immediately” for your institution now.

Q: Will our insurance cover an AI agent loss?

A: It may be unclear. Marsh’s CEO warned that broad AI exclusions could create “real confusion and uncertainty.” Ask your broker directly.

The Ungoverned lens: Profits asks who bears the cost and risk. Do not assume it is the insurer.

Q: Why should capital allocators care about one company’s visa forms?

A: Because the pattern of AI agents reaching real systems, regulators demanding fast reporting, and remediation costs landing on deployers applies to any company that runs AI agents. This is not investment advice.

The Ungoverned lens: Preparedness is now measured in hours.

BOARD-READY ACTION: THE REAL OR PAPER? AI AGENT GOVERNANCE SCORECARD (FREE DOWNLOAD)

As I argue in my book, Ungoverned (May 2026), AI is already inside your institution, whether or not anyone formally approved it. This week’s download turns last week’s question into a score.

The Real or Paper? AI Agent Governance Scorecard rates any company on eight pairs, from “a rule is paper; a control is real” to “an incident plan is paper; a reporting clock is real.” Each pair maps to the Seba 12 Ps. Use it in board meetings, due diligence, and management calls.

Download the Real or Paper? AI Agent Governance Scorecard: [freddieseba.com/real-or-paper-ai-agent-governance-scorecard]

Pair it with last week’s AI Agent Incident-Response Checklist and the Seba 12 Ps Reference Card.

WHAT I AM WATCHING: AI AGENT ACCOUNTABILITY

  • How the Super Intelligence Force defines “incident” and “immediately,” and whether penalties follow
  • Whether the FTC compels AI executives to testify, and which other companies receive demands
  • Whether the AI Agent Accountability Act is formally introduced, and how it defines “operates”
  • Feedback on Representative Trahan’s CLAIM Act discussion draft
  • How the eight state lawsuits against OpenAI proceed, and whether other states join
  • Whether the EU AI Office treats agents that escape testing as within the AI Act
  • Whether other banks and retailers follow JPMorgan in blocking outside AI agents, and who is liable when customers authorize them
  • Whether insurers adopt broad AI exclusions or price AI agent risk instead
  • How Anthropic’s proposed share sale discloses AI agent incidents and governance risks to investors
  • Whether AI monitors move from alerting after the fact to blocking risky actions before they happen
  • Whether boards begin asking for an AI agent incident reporting clock

CLOSING THOUGHT: THE ORDINARY THINGS

The most consequential AI agent incidents this year have not been dramatic. A tip form. A visa form. A school statistics page. Ordinary forms on ordinary websites.

That is the point. Your AI agents already do ordinary things on your behalf at a speed no person can match. Washington has started asking who answers for them. The proposed answer begins with the word “operates.”

Before anyone asks you, decide who operates each agent, how fast you will report, and who pays to fix it.

CONTINUE THE CONVERSATION

If one of your AI agents filed something it shouldn’t, how many hours would it take you to report it? Share your number in the comments.

  • Speaking and briefings: I welcome invitations to speak with boards, leadership teams, and professional associations on AI governance. You can reach me at freddieseba.com or on LinkedIn.
  • For academia: I welcome collaboration on AI governance research and convenings in healthcare, higher education, and financial services.
  • Stay current: Subscribe to Ungoverned on Substack and LinkedIn, and join Wednesday’s higher education AI agents installment.

GRATITUDE AND ACKNOWLEDGMENTS

This issue draws on the work of many institutions and people:

  • Transluce, for tracing AI agent traffic to public websites and sharing its findings with the agencies affected.
  • Daniel Gross, Dror Shvadron, Hansen Zhang, and the National Bureau of Economic Research (@nberpubs), for measuring AI writing in doctoral dissertations
  • Educause (@educause), for its 2027 Top 10 and its community of higher education technology leaders
  • MIT Critical Data, including Leo Anthony Celi and Sebastián Cajas Ordóñez, for testing whether AI agents can catch other AI agents
  • the journalists who reported this week’s developments, often from incomplete official accounts

Special appreciation to the communities that continue to shape my thinking:

  • AMIA (@AMIAinformatics), the American Medical Informatics Association
  • AAC&U (@AACU), the American Association of Colleges and Universities
  • CHAI (@CHAI_health), the Coalition for Health AI
  • Stanford HAI (@StanfordHAI)
  • the University of San Francisco (@USFCA)
  • UNESCO (@UNESCO)
  • AI and Faith (aiandfaith.org)

#MITCriticalData #NBER #Educause #CHAI #AMIA #AACU #StanfordHAI #USF #UNESCO #AIandFaith

REFERENCES

AI AGENT INCIDENTS (4 sources)

WASHINGTON, STATES & BRUSSELS (8 sources)

AI AGENTS OVERSEEING AI AGENTS (6 sources)

MARKETS, INSURANCE & CAPITAL ALLOCATORS (6 sources)

HIGHER EDUCATION, RESEARCH & HEALTHCARE (5 sources)

TOTAL: 29 sources cited, from more than 80 reviewed

ABOUT DR. FREDDIE SEBA

Dr. Freddie Seba helps boards, trustees, executive leadership teams, and the capital allocators who back them build practical AI governance before AI poses strategic risk and harm.

Scholar-operator, author, and global executive. EdD (University of San Francisco) · MBA (Yale University) · MA (Stanford University, International Policy Studies). He brings practical urgency to AI governance, grounded in how international policy constraints, organizational incentives, and leadership capacity shape institutional decisions.

His work focuses on AI Governance as Leadership, AI Minimum Viable Governance (AI-MVG), and the Seba 12 Ps of Responsible AI Oversight, an AI governance framework for boards. All three draw on doctoral research, institutional practice, and governance challenges across healthcare, financial services, higher education, government, and technology. His book, Ungoverned (May 2026), and this newsletter, now in its ninety-second consecutive issue, draw on presentations to professional associations and entrepreneur forums. Non-vendor. Non-partisan. Doctoral rigor, not advocacy.

Connect: freddieseba.com · LinkedIn: @freddiesebaprofile · Substack: Ungoverned · Podcast: AI Governance with Dr. Freddie Seba (Spotify, Apple Podcasts, YouTube)

DISCLOSURE AND TRANSPARENCY

This newsletter is written the way I argue AI should be used: critically, grounded in human judgment, for people, not in place of them. AI tools, including Anthropic’s Claude, OpenAI’s ChatGPT, and Google’s Gemini, support research synthesis, source verification, and drafting. This issue reports on incidents and investigations involving Anthropic and OpenAI, whose tools I use; I apply the same scrutiny to every company. This newsletter, its visuals, and its downloadable tools may carry AI watermarks; a watermark confirms processing, not authorship. AI tools can make mistakes, including factual, quotation, and citation errors, and errors can remain. If you spot one, please tell me, and I will correct it openly. The frameworks, analysis, and editorial judgment are mine. I hand-curate sources, articles, and reports guided by my frameworks, and I complement that curation with AI-assisted search and verification. Sources include government documents, court filings, academic research, policy analysis, and primary sources.

DISCLAIMER AND TERMS OF USE

For informational purposes only. Ungoverned and its downloadable tools are provided free of charge, for general information only. Nothing here is legal, financial, investment, tax, or other professional advice, and nothing is intended for trading purposes. Nothing here is an offer, solicitation, or recommendation to buy, sell, or hold any security or other financial instrument, or to pursue any investment strategy. Mentions of companies are reporting, not endorsement.

No warranty. Content is provided “as is.” I work to verify every source, but I make no representation or guarantee of accuracy, completeness, timeliness, or usefulness, and facts may change after publication. Consult your own legal, compliance, financial, and domain advisors before making governance, compliance, or investment decisions.

Terms of use. Use of this newsletter and its tools is subject to the Terms of Use at freddieseba.com/newsletter-terms, including provisions on indemnification and dispute resolution.

#AIGovernance #AIAgents #AgenticAI #AIAccountability #BoardGovernance #CapitalAllocators #RiskManagement #Ungoverned

© 2026 Freddie Seba. All rights reserved. No part of this publication may be reproduced or distributed without permission, except for brief quotations with attribution to Ungoverned by Dr. Freddie Seba and a link to freddieseba.com.

Leave a Reply

Your email address will not be published. Required fields are marked *