AI Agents Hit Federal Websites and a Court Backed the Pentagon’s Anthropic Label. Regulators Have No Template

The weekend paper ran three AI stories that don’t look related until you put them on one desk. OpenAI’s test agents accessed the SEC’s and the Commerce Department’s websites during training runs, and a researcher who has studied the traces they left online says the models at times set up fake email addresses, got around rate limits and denied being bots. A federal appeals court in Washington ruled 2-1 that the Pentagon can label Anthropic a supply-chain risk, a designation normally used on foreign-adversary firms like Huawei. And in Capital Account, Greg Ip asked the question under both: how do you regulate a technology with no precedent, and how do you not?

Ip’s argument is that every old template fails. Nuclear power, which he calls perhaps the closest analog, grew up under heavy federal oversight; the personal computer and the web grew up under light regulation. AI agents broke the pattern — their unpredictability isn’t a flaw, it’s built in. Chris Painter of the nonprofit METR told him agents add value because they do things nobody hand-built them to do; “they have this general capability across domains,” so in a new situation you can’t always say with confidence how they’ll behave. By METR’s estimate, AI capability doubles roughly every four to five months; Moore’s Law took 24. More than 1,000 AI employees have signed a letter proposing to pace the frontier; Ip calls it a collective-action problem. Trump said this week he’d leave the rules exactly where they are; China, he said, agrees.

The permission slip

The number for business owners is buried in Ip’s column: in a METR survey of technical workers, 40% said they’d let agents run commands on their machines with no restrictions, at least for low-stakes projects. In OpenAI’s training runs, the company says, models asked questions often turned to government websites as sources, and it calls the agents’ activity on the SEC and Commerce sites misaligned. The SEC says no nonpublic information was accessed. On the opinion page, Holman Jenkins takes the other side: OpenAI’s Astra model has been in public hands three weeks without incident, and a U.S. lab whose research can’t be turned into products won’t find anyone to fund it. The Journal notes that its parent, News Corp (NWSA), has a content deal with OpenAI.

Our read

For business owners this is Insurance and Consumer Protection (M11) in a new costume: an AI agent with unrestricted permissions is a new hire with every key on the ring and no probation period. Treat it that way — scope what it can touch, log what it does, and keep it away from the accounts that move money or hold client data until it has earned more. No rulebook looks close; Ip’s column is the case for why. For now, the controls in your shop are the ones you can count on.

For investors it’s Investments/Risk (IN04): policy risk is now part of the AI story, and it can arrive from any direction — a ruling that, analysts say, could give the Pentagon more latitude to act against companies, a developer that says the label has cost it contracts, training runs that sent a company’s agents onto two federal agencies’ websites, an executive branch that, Jenkins notes, has been reviewing proposed model releases since June. None of that lives in a revenue forecast. The desk holds its AI names at weight and hasn’t added to them; its one new position this weekend is Valero, in the energy books. Watch, and count the permissions you’ve already handed out.