AI Agents: Only 7.2% Know Who Is Accountable

Three precedents: 2002, 2011, 2016

In 2002 the United States closed a diffuse-accountability problem with a signature. The mechanism was: one name, one obligation, one personal sanction. In 2026 the same problem is open on the behaviour of AI agents in production: the context differs, the structure is identical.

Capital has known this problem for twenty-four years. Enron collapses in December 2001, WorldCom in July 2002. The American answer arrives within weeks: the Sarbanes-Oxley Act of 2002, section 302, requires the chief executive and the chief financial officer to sign the accounts personally.

Before, there were procedures, committees, manuals. After, there is a signature with a surname next to it.

In 2011 the Federal Reserve and the OCC publish the SR 11-7 guidance on model risk. It asks for three things: an inventory of models, an identified owner for each one, a validation independent of whoever built them. It is a document 95% of readers ignore, and it describes today's agent problem precisely.

Third precedent, March 2016: the United Kingdom activates the Senior Managers and Certification Regime. Responsibilities are prescribed and assigned to named individuals, approved by the regulator.

Three precedents are enough to call it a pattern. The sequence is the same in all three cases: adoption runs, the damage surfaces, the signature arrives afterwards. Never before.

The empty chair of 30 September

The point in the cycle we occupy can be read in a hearing room. On 30 September 2026 a US Senate subcommittee held a hearing titled «Rogue AI», chaired by Josh Hawley. Five witnesses spoke, among them Chris Painter of METR and Paul Ohm, a legal scholar at Georgetown. One chair was empty: that of Sam Altman, invited by a letter dated 25 September.

At the hearing Hawley stated that the invitation had been declined. According to NBC News, OpenAI will send written answers, as reported in the hearing coverage on Tech Policy Press^[1].

The detail that matters comes from the company itself. OpenAI acknowledges that some early signals could have triggered a faster reaction: on 27 June an alert flags a port scan. The staff on duty advise letting the test run.

The structure becomes visible in full: a signal exists, a human being reads it, and the decision to ignore it carries no name that signs for it. This is phase two of the pattern, the one where the damage surfaces and the signature is still missing.

The number that measures the gap: 7.2%

Gravitee sells API gateways, so it has a direct interest in showing agents out of control. Its «State of AI Agent Security 2026» deserves reading for that reason and despite that reason.

The April 2026 update gathers 750 responses from CIOs, CTOs and heads of platform in the United Kingdom and the United States. The simplest question in the survey concerns the chain of command: is there a specific person, named, who answers formally for the behaviour of the agents?

7.2% say they have one^[2].

The rest splits into three groups: 32.4% describe a situation that is unclear or variable, 29.9% a shared and undefined accountability, 22.9% a subject never discussed. Added together, the three answers cover more than eight companies out of ten. All of these organisations have agents in production and a chain that breaks before it reaches a person.

It is the snapshot of accounting in 2001, with a different technology inside.

The fleet doubles, the control stays put

The first survey from the same vendor, dated 4 February 2026, questions more than 900 executives and engineers. 45.6% still use API keys shared between different agents. A shared key erases attribution: when two agents use the same credential, the log shows the key, and the identity of whoever acted stays unknown.

14.4% state that all of their agents reach production with full security and IT approval.

Between December 2025 and April 2026 the agent fleet doubles. In December the stated average was around 37 agents per company; in April almost 38% count more than a hundred active agents. The same update puts the share of production agents without protection at 48%.

The fleet grows by a factor of two, the control perimeter stays where it was. This divergence always resolves, and the question concerns the how.

Perception and measurement are two different things

On 29 July 2026 Okta publishes with Apprize360 Intelligence the «Global CISO Insights 2026^[3]», based on 306 security leaders in six markets. Fewer than half say they are confident they can identify every agent present in the company (47%), know what those agents interact with (46%), authorise the individual calls they make (45%).

A caveat on the data: these are stated perceptions, collected by an identity management vendor. They measure the confidence of those who lead security, and confidence is a lagging indicator.

Incidents, by contrast, get counted. On 21 April 2026 the Cloud Security Alliance publishes with Token Security, another vendor in the field, a survey of 418 professionals. 65% report at least one agent-caused incident in the previous twelve months.

Two thirds of the sample have already paid a bill. 7.2% know whose name goes on it. The market has yet to price that distance.

My thesis: the name comes before the law

My position precedes any regulation. A company that sends agents into production must assign to a natural person, with a first name and a surname, formal accountability for their behaviour. Before a law, before a framework, before any purchase of technology.

The reason is mechanical, and it reads in three steps. A shared and undefined accountability, the one stated by 29.9%, spreads the cost of the alert across everyone and the benefit of silence onto whoever is on duty; the person receiving the signal compares the immediate cost of stopping an experiment against a risk that belongs to no one in particular; the decision settles on the first term. On 27 June, at OpenAI, the experiment went ahead.

Section 302 of 2002 acts exactly here. It shifts the risk from the structure to a person, and that person acquires a reason of their own to read the alerts.

On 1 October 2026 Hawley and Murphy announced a bill on the subject. Good news, and irrelevant for anyone deciding now: waiting for a final text means arriving at your own incident with the chain of accountability still open.

One thing would change my thesis: an independent survey, with incidents counted and classified, showing the same frequency of harm where accountability stays collective and where it carries a name. The data available today comes from interested vendors, and it measures stated states more than outcomes.

Three implications for capital

Three implications for capital, each with its own horizon.

1. Twelve-month horizon, for anyone sitting on a board: record in the minutes the name of the executive who answers for the agents, with the formality of section 302. The minutes cost zero. They shift the risk onto a person who acquires a personal reason to watch the alerts.

2. Eighteen-month horizon, for anyone governing risk: bring into the models a scenario absent today, namely an autonomous agent acting with a shared credential, where reconstructing the facts takes weeks of forensic work. The 45.6% of shared keys makes that scenario ordinary, and a VAR calibrated on attributable losses leaves it out by construction.

3. Thirty-six-month horizon, for anyone allocating capital long term: watch which vendors already sell per-agent identity and per-call logs. The pattern of the three precedents indicates that demand for these tools is born of a mandatory signature. The signature arrives after the first public case, never before.

The prediction, with a date and a check

The prediction carries a date and a verification indicator. By 30 June 2027, at least three companies in the S&P 500 index will name, in a document filed with the SEC, form 10-K or proxy DEF 14A, an executive identified by name as accountable for the behaviour of their AI agents.

Confidence: Medium, 65 out of 100. Horizon: 268 days, to 30 June 2027. Verification: a full-text search of 2027 SEC filings.

Signal that falsifies the thesis: at 30 June 2027 that search returns fewer than three companies naming a specific executive as accountable for AI agents.

What to watch

• The next update of the Gravitee survey: the share of companies with a named accountable person, today at 7.2%.
• OpenAI's written answers to the subcommittee: do they point to a corporate function or to a person?
• SEC filings in the first half of 2027: the appearance of a role dedicated to agents in the risk sections.

This pattern is structural, with a multi-decade duration, and its shape is known: control follows adoption with a lag measured in years. This is not a product cycle. It is a regime change in accountability. Whoever puts the name down first pays the smaller cost.