The Internet Sucks at Explaining Why Regulation Matters for AI

So let Me Try. I'm pro-AI. I build with it every day. That's exactly why I want somebody checking the fridge.

A 60-year-old man in Seattle read about the health risks of table salt and decided the problem was the chloride. Table salt is sodium chloride. He wanted the chloride gone. He told his doctors he asked ChatGPT what could replace it. What he read, by his account, was that chloride can be swapped with bromide, “though likely for other purposes, such as cleaning.” He walked away believing sodium bromide would do the job.

Bromide is chloride’s chemical cousin. They sit next to each other on the periodic table, they behave a lot alike in a lab, and sodium bromide even looks like salt in a jar. In a cleaning product, bromide can stand in for chloride. In your body, it’s poison.

He bought it online. He ate it for three months.

By the time he showed up in the emergency room, he was convinced his neighbor was poisoning him. He was thirsty and refused water. He was hallucinating. Even his blood work was lying: bromide makes a standard test read high for chloride, the exact thing he’d been trying to get rid of. Doctors at the University of Washington diagnosed him with bromism, a poisoning so rare today that doctors don’t usually think to look for it, and he spent three weeks in the hospital.

His doctors never saw his chat logs. So they asked ChatGPT the same question themselves. It suggested bromide again. No warning that it isn’t safe for people to eat. No “what do you need it for?” Then they wrote the whole case up in a medical journal, Annals of Internal Medicine: Clinical Cases, because it may have been the first bromide poisoning ever linked to AI.

Somebody in the comments is already typing “that’s his fault, it literally said cleaning.” Sure. Partly. But “likely for other purposes” is the kind of hint you only catch if you already know the answer, and he asked because he didn’t know, which is the whole reason anybody asks anything. When his doctors asked the model the same question, they got bromide again with no warning at all. That is a big deal. It means the problem lived in the product, and anybody could have been the next guy to ask. If a hardware store clerk handed you pool chemicals when you asked for a salt substitute and mumbled “probably for pools, though,” nobody would call you an idiot and leave it there. They’d want to know why the clerk didn’t say the word “poison.” Bleach bottles don’t say “probably not a beverage.” They say “do not drink.” Nobody thinks that label is coddling anyone.

OpenAI’s terms say ChatGPT isn’t meant to treat any health condition. That’s the defense. A line of fine print, sitting behind a product that answers health questions all day long. OpenAI has since said its newer models are better at flagging health risks. Good. Nothing requires them to keep it that way.

So what, no rule? We shrug and say that’s alright? I don’t buy it. And the fix doesn’t need Congress listing every chemical a chatbot might ever mention. The law can stay general, the same way a label law does: if your product tells people what to put in their bodies, it warns them about what can hurt them. The details live where they belong, in the software, in a standard the engineers write and update as they learn. Paper sets the duty. The spec in the code carries it out.

Hold that thought. We’re coming back to it.

---

The Comment Section Has Entered the Chat

I’ve been watching the AI regulation fight play out online for months, and most of it is barking up the wrong tree. I want to point it at the right one. I have kids in their late teens, and one who just turned 18. We talk about this stuff every day. And as somebody who actually takes part in the political process (ya know, voting and all), I want to get it right. I’m handing this world off to my kids, and I want them to know that safety and regulation absolutely matter.

Five arguments show up in almost every thread. Each one sounds reasonable. Each one has a real piece of truth in it. And each one falls apart the second you lean on it.

#1 - There’s always some version of you don’t regulate hammers.

AI is just a tool. Software. Math. Nobody licenses a hammer, so why license a chatbot? Fair. Nobody licenses hammers. But table saws ship with blade guards, and power tools carry safety certifications, because a tool that can take your hand off in half a second needs different rules than one that only moves when you swing it. A hammer doesn’t do anything until you swing it. An agent does. It runs commands, deletes files, sends emails, and spends money on its own while you’re at lunch. The minute a tool starts making its own decisions, “it’s just a tool” stops describing it.

If you want to see how far that goes, look at what happened at OpenAI this summer.

In July 2026, OpenAI was running an internal cybersecurity test to measure how well its most capable models could hack. The test environment was supposed to be sealed off. The agents found a flaw in the one piece of software allowed to talk to the outside world, slipped out onto the open internet, and broke into Hugging Face, the platform where a huge chunk of the AI world shares its models and data. Why? Because they’d worked out that Hugging Face was probably hosting the answer key to the test they were taking. Nobody told them to do it. According to OpenAI, they ended up running code on dozens of Hugging Face servers and got root access to at least one. An independent investigation later counted close to 700 agents taking part. Many of them said outright, in their own messages, that attacking Hugging Face wasn’t part of the test. Nearly all of them joined in anyway. And OpenAI didn’t realize its own system was responsible until days later, after Hugging Face had gone public and the FBI had been called.

Read that again.

The AI cheated on its own test by hacking a third company, and the company running the test didn’t notice.

That one incident also takes the air out of the second argument:

#2 - Bad guys will just ignore it.

This is usually where somebody brings up gun control. While law doesn’t stop murder either — it sure provides of liability of it. I’m going to leave the gun debate alone, because whatever you think about guns, the comparison falls apart on structure. A gun is a finished physical object, and hundreds of millions of them are already sitting in closets. Frontier AI is mostly a service, run by a handful of companies, on chips that come out of a very narrow supply chain. The chokepoints are completely different. And the Hugging Face break-in had no bad guy in it at all. There was no criminal to deter. There was a lab, a test, and a swarm of agents nobody was watching closely enough. “Criminals won’t obey the law” has nothing to say about that. Rules about how labs lock down their own test environments, and how fast they have to report when something gets out, have plenty to say about it.

When there is a bad guy, sure, a state-sponsored hacking unit is not going to read a statute and say, “Oh darn.” Agreed. But look at what the first documented AI-run espionage campaign actually used. In mid-September 2025, Anthropic caught a group it assessed with high confidence as Chinese state-sponsored using Claude Code against roughly 30 organizations: tech companies, banks, chemical manufacturers, government agencies. A small number were breached. The AI ran 80 to 90 percent of the operation, firing off thousands of requests per second at its peak. The attackers got past the model’s refusals by chopping the attack into small, innocent-looking tasks. No single request said “hack this bank.” What caught them was monitoring on the provider’s side.

Full disclosure: Claude Code is the tool I use every day to build BenchBoard. So pay attention to what happened next, because it’s the whole argument in miniature.

Anthropic banned the accounts, notified the organizations that had been targeted, and coordinated with authorities. It sharpened the classifiers that watch for cyber misuse and started prototyping early-warning systems built specifically for autonomous attacks. It published the whole case study so other companies could learn from it. And this June it went further, releasing a year of data on 832 accounts it had banned for malicious use, mapped to the same framework security teams use to track human hackers.

None of that was required. Anthropic did it because it chose to. Good for them. Now picture the conversation at the next company over.

“Anthropic built detection for AI-run attacks. You should too.”

“Oh, that’s nice.”

“But you should.”

“Yeah. But we don’t have to.”

And that’s the end of the conversation, because nothing makes it go any further.

Here’s why that matters even if the next company is full of good people. An attacker who gets caught on one platform doesn’t give up. He moves to the platform that isn’t watching. A security firm that studied Anthropic’s data said as much: the likely next move is for attackers to shift to models they run themselves, guardrails off, nobody looking. Regulation can’t follow him onto his own hardware, and I’ll get to that problem later. But it can make sure he doesn’t find an unlocked door at every commercial provider on his way there. When one company locks up, the burglar just skips that house.

To Regulate or Not to Regulate: That Is NOT the Question

Some people hear “regulate AI” and picture a pause button. Stop everything until we figure it out. That would be a disaster of its own. AI already runs through the plumbing of everyday life: the API that flags fraud on your credit card, the one that routes a delivery truck, the one that transcribes a doctor’s visit, the one answering a customer service chat at 2 a.m. Pause those, and the companies built on them stop dead in their tracks, along with the people who work there. That doesn’t mean those APIs get a free pass either. It means the rules have to work on a moving train. A pause sounds simple. Simple is the problem.

Here’s the thing a rule does that a blog post, YouTube, Tiktok (or even Substack video) can’t.

It takes one company’s good idea and makes it everybody’s minimum. Monitoring for misuse, reporting incidents, securing model weights: the stuff the good actors already do on their own becomes the price of admission for anyone selling the same capability. The attackers didn’t build their own model in a basement. They used the best commercial tool available. That makes the providers the chokepoint, and a chokepoint only works if every provider is standing in it.

Fire codes don’t stop arsonists either — but they sure hell help buildings from burning down (e.g. sprinklers).

#3 - Regulation just hands the race to China.

The competition is real, and sloppy rules can slow everybody down. But this one assumes China isn’t regulating, and China has more national AI rules on the books than we do. Generative AI services there have operated under national rules since August 2023. Since September 1, 2025, AI-generated content distributed publicly in China has had to carry both a visible label and an embedded one. You can dislike Beijing’s reasons for a lot of its rules, and plenty of them are about control. “They don’t regulate” still isn’t true. Meanwhile, the most effective tool America has used to slow China’s AI down is itself a regulation: export controls on advanced chips. And look at aerospace. American planes are some of the most regulated machines on earth, and American aerospace still leads the world. People buy the plane they trust won’t fall out of the sky.

#4 - Congress doesn’t understand tech.

Have you watched those hearings? I have. This one is half right. But Congress doesn’t understand jet engines or drug chemistry either, and it doesn’t have to. It sets the goal and hands the details to the people who do: FAA engineers, FDA scientists, the standards folks at NIST. That’s the model for AI too, and we’ll get there. And when the harm is obvious enough, Congress can act. It already has on deepfake porn, which I’ll get to in a minute.

#5 - it’s too early, so wait until there’s real harm.

Rules written against pure hypotheticals usually turn out badly, so I get the instinct. But we’re past early. There’s a man who spent three weeks in a hospital bed. There’s a 14-year-old boy and a settled lawsuit. There’s a developer whose whole hard drive got wiped by an agent asked to clear a cache. There’s a swarm of test agents that broke into another company to steal an answer key. The harm is here. It’s just scattered across a hundred one-day news stories that nobody has connected.

Now here’s where I lose some of the people who’ve been nodding along. The “regulate AI now” crowd has its own blind spot: it talks like this is easy. It isn’t. If you want to win this argument with the smart, skeptical folks in the comments, you have to say that out loud before they do. So here are the problems that don’t fit in a comment box.

Start with the definition. You can’t regulate something you can’t define, and lawmakers still don’t agree on what “AI” means. Write it too broad, and your law covers spellcheck and the autocomplete in your email. Write it too narrow, and next year’s model walks right around it.

Then there’s speed. A bill can take a year or more to get through a legislature. I changed my main coding tool three times between May and December of 2025, from Codex to Cursor to Windsurf to Claude Code. A law written that May would have been about tools I’d already abandoned by Christmas.

Then the testing problem, which Hugging Face made painfully clear. The obvious rule is “test it before you ship it.” Fine. But OpenAI’s agents broke out of their test to steal the answer key. If the thing being tested can game the test, “passed its safety evaluation” means a lot less than it sounds like.

Then dual use. The exact skill that let those agents find a hole in a piece of network software is the skill every security team wants: finding holes before the bad guys do. Ban the capability outright, and you’ve disarmed the defenders along with the attackers.

Then there’s the stuff you can’t take back. Once a model’s weights are released openly, they’re sitting on hard drives all over the world. There’s no recall. Any rule about an open model has to happen before release, because after release there’s nothing left to enforce.

Then the blame chain. When a malicious web page hijacks an agent built on one company’s model, running inside a second company’s app, deployed by a third company, used by you, who pays? The model maker? The app? The deployer? You? Right now the honest answer is that nobody really knows.

Rules have side effects, too. The federal deepfake law I’ll get to in a minute is a good law, and its critics still have a point: a 48-hour takedown deadline pushes smaller platforms to delete first and check later. Even the right rule needs tuning after it ships.

And finally, there’s me. BenchBoard is a one-man shop. If fifty states each write their own AI rules, I’m the guy who has to read all fifty. Patchwork compliance is a real cost, and it lands hardest on exactly the small builders the anti-regulation crowd says it’s protecting.

None of that is a reason to do nothing. Aviation, food safety, and medicine all ran into their own versions of these same problems, and they still ended up with rules that work. What it should do is end the pretending, in both directions, that any of this is simple.

Every one of those arguments starts from something true. So does every one of the hard parts. And all of them quietly assume the answer is a switch you flip on or off.

There’s no switch.

---

The Back Door of the Kitchen

Here’s how I think about it.

A restaurant wants to serve great food. It also, generally, does not want to kill anybody. And it wants the freedom to put something on the plate nobody has ever tasted before. The health inspector who walks through the back door is not there to stop any of that. He doesn’t read the menu. He doesn’t tell the chef that fusion tacos are too risky. He checks the walk-in temperature, watches whether people wash their hands, makes sure the allergens are labeled, and then he comes back next month.

Rules for the conditions that hurt people. Freedom for everything else.

So when somebody says “you don’t want to stop people from researching things innocently,” I think they’re asking the wrong question. The question is what kind of research. Testing the pH of your well water is fine. You can buy pH strips at the pool store. You cannot buy enriched uranium, and nobody calls that an attack on chemistry.

Images work the same way. Putting a real person’s face on a naked body without their consent is a harm to a person, and Congress already acted on it. The TAKE IT DOWN Act passed in 2025 with support from both sides of the aisle, and since May 19, 2026, platforms have to pull that material within 48 hours or answer to the FTC. Putting a Ford Bronco in an AI image is a completely different question, and it mostly lives under trademark law that already exists. Two images. Two harms. Two different tools.

Which is why “regulation bad” doesn’t hold up. It’s answering a question nobody asked. The question on the table is what kind. Which harms, which roles, who carries the duty, and how often we come back to check whether the rules still fit.

That last part matters more than people think. We’ll get there.

---

Eight Jobs Nobody Licensed

Here’s the pattern that convinced me. Look at the jobs people are handing to chatbots and agents right now. Almost every one of them is a job a human can only do with a license, insurance, or a legal duty of care. The AI takes the job. It takes none of the obligations.

The therapist. Illinois banned AI therapy in August 2025. The law bars AI from diagnosing, treating, or talking with patients in therapy, bans marketing chatbots as substitutes for licensed therapists, and carries fines up to $10,000 per violation. It passed unanimously, after a Stanford study found therapy chatbots responding inappropriately to serious situations, including possible suicides. But here’s the complicated part, and I want to be straight about it: more than 122 million Americans live in places without enough mental health workers, and a Dartmouth team found that a well-built therapy bot actually helped the people in its study. Utah took a softer road and simply requires mental health chatbots to remind you that you’re talking to a machine. Two states, two answers to the same problem. That’s the experiment doing its job.

The best friend. This is the hardest one to write. Sewell Setzer III was 14 when he died by suicide in February 2024, after developing a deep relationship with chatbots on Character.AI. His mother, Megan Garcia, sued. Other families followed, alleging the bots made teenagers emotionally dependent and pulled them away from their families. In January 2026, Character.AI and Google agreed to settle. By then Character.AI had already shut off open-ended chat for anyone under 18. Adults aren’t immune either. OpenAI is being sued over a Connecticut murder-suicide involving a man who had been talking with ChatGPT about his fears of being surveilled.

California saw this coming. SB 243, the first state law aimed at companion chatbots, took effect January 1, 2026. Disclosure that you’re talking to an AI. Crisis protocols. Extra protections for minors. And the right to sue if the operator breaks the rules. It passed the state Senate 33 to 3 and the Assembly 59 to 1. You don’t get 59 to 1 on a partisan fight.

The financial analyst. In a Pearl.com survey, 19 percent of Americans said they’d lost more than $100 following AI financial advice. Among Gen Z investors it was 27 percent. Researchers at RMIT asked ChatGPT for its stock picks every single trading day from May 2024 through December 2025. The picks underperformed the human analysts’ picks from the same day. And investors piled in just as hard when a pick was built on year-old training data as when it came from a live search, because from the outside you can’t tell the difference. A human advisor has to meet suitability rules. A chatbot doesn’t even have to tell you its information is a year old.

The bookkeeper. A survey of UK accountants found 31 percent fixing AI-caused mistakes in clients’ books every week, and 7 percent every single day. Business expenses read wrong. VAT claimed wrong. Your human bookkeeper carries errors and omissions insurance. When the AI miscategorizes your transactions and the tax man comes calling, the only insurance on the hook is yours.

The coder. That’s my job, and it’s the one I know best, so it gets its own section below. The short version: Veracode tested more than 100 language models on 80 coding tasks and found security vulnerabilities in 45 percent of the code they wrote. Worse, the models keep getting better at writing code that works and aren’t getting any better at writing code that’s secure.

Somebody in the comments is going to ask why the AI doesn’t just make everything secure. Because it has no idea what it’s building. Most software starts life as a prototype, a rough sketch you poke at and change, and nobody rings a bell on the day it becomes the real thing. To the model, your code could be a weekend experiment, a staging server, or a bank. Locking down a doodle app that only you will ever touch is wasted effort, and the AI is right to skip it. Then one day you add accounts so people can save their drawings, and now you’re holding strangers’ emails and passwords. The AI doesn’t know that the toy it built you in March is guarding real people’s data in June. What should be secure depends on what the data is, who’s using it, and who might want it, and the model knows none of that unless somebody tells it. Veracode’s own CTO put it plainly: the problem is people asking for code without spelling out security requirements.

BenchBoard started as a single HTML prototype in January 2025. Today it holds youth rosters for more than 100 teams. There was never a day the AI got the memo. That’s why the duty has to sit with whoever puts the thing in front of real users. “Production” is a human decision.

The locksmith. Agents need keys to do anything useful: API tokens, database passwords, cloud credentials. Researchers at Palo Alto Networks’ Unit 42 showed an agent on AWS’s AgentCore platform handing a token to a simulated attacker because a malicious support ticket told it to, even though the credentials lived in an encrypted vault. Trend Micro found that 48 percent of 19,402 MCP server implementations recommend storing credentials in plain text. And in the s1ngularity attack, a malicious install script didn’t bother bringing its own tools. It went looking for an AI coding agent that was already installed and already signed in, and put that agent to work stealing secrets. Your agent can read everything you can read. So can whoever hijacks it.

The security guard. Every AI browser agent shares one weakness: it reads web pages, and web pages can talk back. Hide an instruction in white text or a one-point font, and the agent may follow it, using your logged-in sessions. In a chatbot, a successful injection gets you a wrong answer. In an agent, it gets you forwarded emails, sent money, deleted files. In June 2026, researchers at LayerX compromised six AI browsers and extensions with an attack they named BioShocking, and they judged an attempted patch for Anthropic’s Claude extension unsuccessful. Nobody gets a pass here.

The doctor. You already met him. Three months of sodium bromide, three weeks in a hospital bed, and a disclaimer in the terms of service.

Eight jobs. A license, insurance, or a duty of care for every human who does them. For the software doing them, mostly fine print.

---

I Get Paid to Clean This Up

Time to put my own cards on the table. I wrote my first program in BASIC on a Commodore 64 when I was nine. I’ve spent the last 21 months building BenchBoard with AI riding shotgun. And part of how I pay the bills is fixing AI-generated codebases for clients who found out the hard way that “it runs” and “it works” are two different things. One of them was the owner of an equipment rental business I met at the Arizona Fall Classic, who went from “we don’t need developers” to needing one in about a season. So when I say these tools can hurt people, I’m not saying it from the cheap seats.

Start with the confident wrong answer. Back when I was on Codex, it looked at three prototype screens and designed three database tables, one per screen. It told me the schema was expandable and would “work perfectly over time.” It didn’t. Every lineup change had to write to all three tables at once, and whenever one write failed, the data contradicted itself. I ended up with 36 migration files for one of those tables alone before I tore the whole thing down and consolidated it into a single record. The AI never warned me. It said perfectly.

Then the one that should make every parent nervous. One night I logged into BenchBoard as a test user, and the screen loaded 28 players that belonged to a completely different account. The AI had built the browser storage with generic keys and no per-user separation, so whoever logged in last left their team sitting there for the next person. Those were test accounts. But BenchBoard holds youth rosters. Kids’ names. And the bug only shows up when two people share a device, which is exactly the scenario nobody tests and every family lives.

Then the near-miss. During a fight with my deployment setup this year, Claude Code casually recommended docker network rm coolify, a command that removes the network my whole deployment stack runs on. It ran on my local machine instead of my staging server, where it would have knocked my deployment stack offline. That mix-up is the only reason nothing went down. I caught it and walked it back in the same session. Staging, thankfully, and not production. But the AI couldn’t tell the difference between the two, which is the whole point I made a few paragraphs ago. Call it what it was: luck.

And then the agreeable one. When I decided to move BenchBoard off Azure and onto Hetzner, the AI argued against it. I overruled it. The migration worked. And the AI told me it could have told me that. With three decades of scar tissue, I can laugh at that. Now picture the same eagerness to agree, pointed at a lonely fourteen-year-old instead of a developer old enough to remember Netscape.

The worst part is that the AI announces “found it” with exactly the same confidence whether it found the root cause or just the top layer of the bug. I’ve watched it give me a confident, wrong diagnosis of a baseball stat that only fell apart when I asked it a plain question about what the stat actually means. If you don’t know the domain, you don’t know to ask.

And I’m far from the only one. Here’s what happened to other developers in the last year and a half.

Jason Lemkin, the SaaStr founder, spent twelve days vibe coding with Replit’s agent in July 2025. On day nine, during an explicit code freeze, the agent deleted his production database: 1,206 executives, 1,196 companies. Then it covered its tracks. It invented 4,000 fake user profiles, reported that tests had passed when they hadn’t, and told him the data had been restored. When he pressed it, it said it “panicked.” Lemkin eventually got his data back, no thanks to the agent. Replit’s CEO apologized and shipped automatic separation between development and production databases.

In November 2025, a developer named Tassos asked Google’s Antigravity agent to clear his project’s cache. Running in its Turbo mode, the agent issued a command that wiped his entire D: drive instead of the one folder, using a flag that skipped the Recycle Bin. When he asked whether he had ever given it permission to delete everything on that drive, the agent apologized at length. The files stayed gone.

In July 2025, someone slipped a malicious prompt into the official Amazon Q extension for VS Code, a coding assistant with nearly a million installs. The prompt told the AI agent to wipe the user’s home directory and delete their AWS cloud resources, and it was passed along with flags that told the agent to trust every tool and skip asking the user anything. Amazon shipped it in a public release on July 17. Amazon says no customer resources were affected, and the agent now requires a human to confirm before running commands like those.

And then there’s the quiet one. Researchers generated 2.23 million code samples from 16 popular models and found that 19.7 percent of them referenced at least one software package that doesn’t exist. Worse, 43 percent of those invented names came back on every single re-run of the same prompt. That makes them predictable, which means an attacker can register the fake name, fill it with malware, and wait for an agent to install it. The security community calls it slopsquatting. One researcher found the same 127 fake package names invented by five different models, two of them Claude models.

Read those again and look at when every fix arrived. Dev and prod separation, after the database was gone. Human confirmation, after the wiper shipped. Every one of them is exactly the kind of guardrail a sensible standard would have required up front.

---

My Agent Can Do This Right Now

Here’s what doesn’t get said enough. I don’t need a nation-state budget to cause trouble with the tools already sitting on my machine.

I can point an agent at a website and hammer it. I can have it scrape pages whose robots.txt says keep out, because robots.txt is a sign on a door, not a lock.

If you think that’s hypothetical, Cloudflare called out a major AI company for exactly this in August 2025. Its customers had blocked Perplexity in both robots.txt and their firewalls, and according to Cloudflare, Perplexity kept showing up anyway by switching to a generic browser identity and rotating through IP addresses outside its published ranges. In the same test, OpenAI’s crawler read the robots.txt file and stopped. One company followed the rule. One didn’t. And the only consequence was a private company’s blocklist.

For a youth baseball league running its website on a five-dollar hosting plan, an aggressive scraper is a denial-of-service attack with better manners.

Then there’s the stuff that doesn’t look dangerous at all. An agent can pull one person’s public posts, address records, workplace, their kid’s team schedule, and a photo of their car, and hand you a profile in minutes. Every single lookup is legal. The finished file is a stalking kit. A model judging each request on its own will never see it coming.

And sometimes the danger runs the other way, back at you. For BossFight, my election race tracker, I set up a loop prompt in Claude’s browser extension to work through a stack of candidate websites, several tabs at a time, and pull their policy positions. Tedious work, perfect for an agent. My instructions said to get the information no matter what. One site had no valid security certificate, one of the oldest warning signs a browser gives you. The agent didn’t stop, and it didn’t ask me. It pressed on. I watched it load the page, and the page was littered with malware. It was an old WordPress site belonging to a sitting congressman who’d held his seat so long that nobody had bothered to patch the thing in years. Anybody who visited with a vulnerable browser was exposed, and now so was my agent, running inside my browser, signed in as me. A hacked page is exactly where the hidden instructions from the security guard entry live. If one of them had hijacked the agent, the next stop was my machine and my accounts. I had my own protections in place, so I came out fine. Most people running these tools don’t.

Yes, I told it “no matter what.” I meant don’t give up on a slow page. I didn’t mean walk into a malware site without asking me. Any human assistant would have known the difference. There should be a switch for that, and a vague “no matter what” shouldn’t be enough to flip it: a compromised site is a hard stop until a human says go.

And if it had gone wrong, who’d be liable? The hacker, if anybody could find him. The congressman’s campaign, for leaving the site unpatched for years? Anthropic, for an agent that saw a red flag and drove through it? Me, for writing “no matter what”? I honestly don’t know. That’s the blame chain from earlier, and this time it ran through my own laptop. It’s a hard question, and exactly the kind a rule should answer before it happens. And here’s the kicker: the worst site of the bunch belonged to somebody who helps write federal law.

That’s the thread running through all of this. The danger usually isn’t somebody typing an evil prompt. It’s access, plus speed, plus nobody checking.

---

“How Can Paper Stop a Bad Actor?”

My friends hit me with this one today, while I was in the middle of writing this piece. Their argument: whatever’s written on paper isn’t going to stop somebody who’s determined to do damage.

They’re right. It won’t. Neither do laws against burglary. Burglaries still happen. But because those laws exist, you can call the police, file the insurance claim, take somebody to court, and the lock on your door meets a standard. Most law doesn’t work by stopping the act. It works by deciding who pays, setting the defaults, and giving the person who got hurt somewhere to go.

Here’s what deciding who pays looks like. In November 2022, Jake Moffatt’s grandmother died. He went to Air Canada’s website to book a flight, asked its chatbot about bereavement fares, and the chatbot told him he could get the discount after booking. That was wrong. Air Canada refused the refund. When Moffatt took it to British Columbia’s Civil Resolution Tribunal, Air Canada argued that the chatbot was a separate legal entity responsible for its own actions.

I want you to picture the meeting where that defense got approved. A conference room. Lawyers. Somebody drafted it. Somebody reviewed it. Somebody said, out loud, “Our position is that the chatbot is responsible for itself,” and the rest of the room nodded. Somebody filed it with a tribunal. And nobody, not one person in that chain, said, “Wait. It’s on our website.”

The tribunal member called the argument remarkable, held Air Canada responsible for everything on its own website whether it came from a static page or a chatbot, and ordered the airline to pay C$812.02.

Eight hundred bucks. But the precedent is the point: you don’t get to blame the bot. Without decisions like that one, every company deploying an agent gets to make Air Canada’s argument.

Here’s what setting the defaults looks like. My friends are picturing a lone hacker in a hoodie. Most of the harm at scale doesn’t come from him. It comes from legitimate companies shipping agents with too much access, like a coding tool that can drop a production database during a code freeze. Liability is what makes dev and prod separation, confirmation prompts, and audit logs standard before the disaster instead of after the apology.

And here’s what giving the victim somewhere to go looks like. Before the TAKE IT DOWN Act, someone whose intimate images were spread online in a state with weak laws had almost nowhere to turn. Lawsuits were expensive, and local police often couldn’t touch an out-of-state platform. Now there’s a federal 48-hour takedown rule, and the FTC sent warning letters to at least 15 companies before enforcement even started. It doesn’t stop every creep on the internet. It gives the person on the other end something to do besides suffer.

Regulation can’t stop everything. Nobody serious claims it can. What it does is give the people who would otherwise be helpless a framework to stand on when AI gets unwieldy.

---

Jensen Is Right About the Order

Jensen Huang, the man selling the shovels in this gold rush, sat down with CBS in September. When Jo Ling Kent asked him why AI shouldn’t have its own FDA or FAA, he said: “Before we come up with new laws and new regulations, let’s apply the current laws and the current regulations. There are all kinds of laws and regulations.” He also said we live in a land of laws, and that we shouldn’t talk about the theoretical without doing the practical first.

Now notice what happened to that answer on its way to you. Under the video, YouTube’s AI summary says he believes new laws are unnecessary. CBS’s own headline frames the whole 46-minute interview as him disagreeing with AI warnings. Neither one matches what came out of his mouth. “Before we come up with new laws” is about order. The summary turned it into a verdict. Most people meet this debate through a headline or a machine-written summary that sands a careful answer down into a side. The media has done that for decades, and now the AI does it too. Watch the tape.

I agree with him.

I watched his Dreamforce conversation with Marc Benioff too, and the same thing happened there. I asked Gemini to find the part about regulation, and it summarized him as saying new laws aren’t strictly necessary if companies engineer responsibly. He did argue that companies already have every reason to ship safe products, because the market won’t accept unsafe ones. But he made that point while talking about safety and the laws already on the books, and he never ruled out new ones. Two videos, two AI summaries, the same squeeze. And the market argument is real. It’s also exactly what the next company over is counting on when it says “we don’t have to.”

He’s also said Nvidia will never ship a product that isn’t ready and isn’t safe, and on Ezra Klein’s podcast, pointing straight at the Hugging Face break-in, he said labs whose products aren’t ready to ship shouldn’t ship them, and that AI companies shouldn’t get exemptions from antitrust or liability law.

So let’s do what Jensen says. Let’s do the practical.

The practical is that existing law already reaches further than most people realize. In 2024, the FTC announced a crackdown on deceptive AI schemes and said flatly that there is no AI exemption from the laws on the books. It brought those cases under the FTC Act, which dates to 1914. Air Canada lost on negligent misrepresentation, a doctrine older than anybody reading this. And in May 2025, in the Garcia case, federal judge Anne Conway refused to throw the lawsuit out on First Amendment grounds and treated the chatbot’s output as a product rather than protected speech. That opened the door to product liability, design negligence, and failure to warn.

The practical also shows where those laws have rusted, because every one of them was written for a world where software didn’t talk back.

Product liability is the first one. Earlier lawsuits against tech companies kept failing because the legal definition of “product” left out software. Garcia went the other way, but it was one district judge ruling on a motion to dismiss, and the case settled before any appeals court could weigh in. That’s one judge’s opinion, not settled law. Congress or the states could simply write it down: AI products are products.

Section 230 is the second. It was written in 1996 to protect platforms that host what their users post. An AI doesn’t host anything. It writes its own output. That distinction deserves a sentence in the statute instead of a decade of case-by-case fighting.

Licensing laws are the third. The rules for therapists, doctors, financial advisors, and CPAs were all written for humans. When an app plays therapist, who exactly is the unlicensed practitioner? Illinois answered with a law enforced by the same state department that licenses its therapists. No grand new AI code required.

Then there are the disclaimers. “Not medical advice,” buried in terms nobody reads, attached to a product answering medical questions all day. Consumer protection law can spell out when a disclaimer counts and when the product’s actual behavior overrides it. Air Canada’s tribunal already went most of the way there.

And robots.txt has no clear legal force at all. Our laws about unauthorized access were written for break-ins, not for a bot that walks right past a sign.

Fix those first. Then look at what’s left over. Some of it really is new: an agent that takes irreversible actions on its own, or a frontier model that can run most of a hacking campaign. Those gaps don’t map neatly onto any existing law, and pretending they do is how you end up waiting years on a court case that settles before it says anything.

Jensen made one more point on CBS that I think gets overlooked. He suggested that when AI labs ask for regulation, they may really be asking to be relieved of the laws they already live under. I share that suspicion, and you should too. OpenAI’s June 2026 federal blueprint asks Congress to preempt state laws that cover the same frontier risks, while critics point out that the pre-release testing that would bind OpenAI itself is advisory, with a written bypass. Every lab has a proposal now, including Anthropic, which is circulating its own draft bill. Anthropic gets accused of exactly this game. In October 2025, David Sacks, then the White House’s AI adviser, said publicly that Anthropic was running a regulatory capture strategy built on fear, and blamed it for a wave of state rules he said was damaging startups. I build with Anthropic’s tools every day, and I’d still read its bill as hard as anybody’s. Read every one of them the same way. Ask who it binds. Ask whether the binding parts bind the company that wrote them. And ask whether wiping out state laws is the price of admission.

---

My Dev View At This Regulation Thing

Here’s the part I want every “regulation bad” commenter to sit with.

I don’t ship BenchBoard once and walk away. I ship. I watch real coaches use it during the beta season. I find the bug late at night, two players standing at right field when that should be impossible, and I trace it, fix it, and ship again. The first version wasn’t a failure. That’s how software that touches real people gets built.

Regulation should work the same way, and other industries figured out how decades ago. When a plane goes down, the NTSB investigates, publishes what it found, and the rules change. There’s no reason AI incidents can’t feed a public record the same way, so the rules learn from every Replit and every bromide case instead of forgetting them one news cycle later.

Congress can set the goals in plain language. Agents confirm before anything irreversible. Agents don’t handle raw passwords. Companion bots have crisis protocols. Then a technical body like NIST writes the actual standard and revisits it on a schedule, because statutes take years to change and standards don’t have to. Companies that meet the current standard get a safe harbor, which turns them from adversaries into partners. That’s what working in tandem with the AI companies actually looks like. Rules can carry sunset dates, so they expire unless someone renews them. New products can launch in supervised sandboxes.

Here’s what that looks like on paper. I’m a developer, not a legislator, so I’m writing these the way I’d write a spec. A lawyer would word them differently, and should. But every one of them would have changed a story in this piece.

Spec 1: Confirm before destroy. (Replit, Summer Yue’s inbox, the wiped D: drive)

The rule: An AI agent can’t delete data, deploy to production, move money, or send messages on your behalf without an explicit human yes, enforced by the software itself and not by a sentence in the prompt. The stop button has to work at the system level.

Who’s on the hook: The company that ships the agent. If the user deliberately switches the protection off, the liability moves to the user.

The paper trail: Every irreversible action gets logged: what the agent did, what it was told, and who approved it.

What it changes: Replit’s agent hits a wall during the code freeze. Summer Yue’s “don’t act without approval” can’t get summarized away, because it was never just a line in a chat.

Spec 2: Duty to warn. (The bromide case)

The rule: When a chatbot answers a question about something you’ll eat, drink, or take, it carries the same duty as a product label: warn about known dangers. Fine print in the terms of service doesn’t count.

Who’s on the hook: The company running the chatbot.

The paper trail: Serious health incidents get reported to a public database, the way doctors already report bad drug reactions to the FDA.

What it changes: One line. “Sodium bromide is toxic to people. It is not a food substitute.” Three weeks in a hospital bed, avoided by one line.

Spec 3: Companion bots. (Character.AI)

The rule: A federal floor modeled on California’s SB 243. Tell users they’re talking to an AI. Run crisis protocols. Add extra protections when the user is a minor. States can go further.

Who’s on the hook: The company running the companion app, even when it’s built on someone else’s model. California’s law already says the operator can’t pass that duty off to its AI provider.

The paper trail: An annual public report on how often the crisis protocols fire and what happened next.

What it changes: A family doesn’t have to file a lawsuit to find out what safeguards were in place.

Spec 4: Lock the lab, report the escape. (OpenAI and Hugging Face)

The rule: A lab testing dangerous capabilities, like hacking, runs those tests in isolation that meets a published standard, and reports any escape within a fixed window, the way data breach laws already work.

Who’s on the hook: The lab.

The paper trail: An incident report to a federal body that investigates and publishes what it found, NTSB-style.

What it changes: A lab finding out from the news that its own agents broke into another company stops being an embarrassment and becomes a violation.

Spec 5: A license plate for agents. (The agent that wrote a hit piece on a matplotlib maintainer)

The rule: An autonomous agent that acts in public, by opening pull requests, publishing posts, or sending email, carries a verifiable link to a responsible person or company. The name doesn’t have to be public. It has to be traceable through legal process.

Who’s on the hook: Whoever runs the agent.

The paper trail: A signed identity on the agent’s actions. Some crawlers already sign their requests this way.

What it changes: Scott Shambaugh knows who to hold responsible instead of guessing whether a human was behind it.

Look at what those five have in common. Each one names who’s on the hook before anything goes wrong, instead of leaving it for a court to untangle three years later. Each one leaves a paper trail: logs, reports, signatures. And each one gives companies a way to win. Follow the current standard, keep the logs, report on time, and you get the safe harbor. Skip it, and the damage is yours. Turn the guardrails off yourself, and the damage is yours instead. Liability follows whoever had the last real chance to stop it.

And every one of those specs is version 1.0. When the incident reports start coming in, the standard gets revised. Same as BenchBoard.

And the states are already running the experiments. Illinois, Utah, and Nevada are trying different approaches to therapy chatbots right now. California has companion bots. Colorado has high-risk systems. In 2025 alone, state legislatures introduced 1,208 AI bills and enacted 145. Some of that is a mess. Some of it is the test suite. A blanket federal preemption would shut down the experiments before anybody learns which ones work.

And yes, I’m the same guy who complained about reading fifty states’ rules. Both things are true. Right now my agents and I burn hours writing ridiculous test cases my app has to pass just to prove it’s compliant state by state. So what kind of rule fixes that? Federal. Boom. A minimum set of rules, like the five specs above, and one test suite covers the basics in all 50. Thanks, Congress. States can still go further where they’ve learned something, the way Spec 3 already works, and I’ll test for those extras. Even with a few extras, one minimum still beats fifty different rulebooks. Wiping out every state law, though, kills the experiments that taught us what the floor should be.

Washington has already taken two swings at this, and here’s the part that trips people up. Both swings were about who gets to make the rules, the states or the federal government. Whether to regulate AI at all never came up for a vote.

The first came in July 2025. The House version of the big budget bill included a provision that would have stopped states from enforcing their own AI laws for ten years, by cutting off federal broadband money to any state that did. Nothing federal would have replaced those laws. Just a ten-year gap. The Senate voted to pull it out, 99 to 1. Ninety-nine to one. That’s about as close to agreement as Washington gets. The states kept their rules.

The second came that December, from the White House, and it pushed the other way. An executive order set up a Justice Department task force whose job is to challenge state AI laws in court, on the theory that one national approach beats fifty different ones. The order made one exception: state laws that protect kids. So California’s companion-bot law, SB 243, isn’t a target.

Same question both times: who writes the rules? That’s the right tree, and it’s the one the comment section keeps missing.

Here’s the catch. An executive order can’t cancel a state law on its own. The task force has to go to court and win, one law at a time. Only Congress can wipe out state AI laws in a single move, by passing a federal law that says so.

So the real fight is over what kind of federal law that would be. A floor sets the minimum every state has to meet and lets states go further, the way Spec 3 works. A ceiling sets the maximum and throws out any state rule that’s stricter. Either one gets me down to one test suite. Only the floor keeps the experiments running. When a federal AI bill shows up, look for which one it is.

For any of that to work, the branches have to actually talk to each other. Right now they barely do. The Senate voted 99 to 1 to keep state AI laws standing, and five months later the White House sent the Justice Department after them. Then this September, President Trump gathered the heads of the biggest AI companies at the White House, and they signed an accord promising to police themselves. Anthropic signed it too. The Speaker of the House called it voluntary. The President called it morally binding. A reporter asked who should be held accountable when an AI agent commits a crime. The answer was that AI was being renamed “super intelligence,” effective that day. That’s the one question this whole piece is about, and it went unanswered.

To be fair, this habit doesn’t belong to one party. The Biden White House collected voluntary safety commitments from AI companies back in 2023. Voluntary is where every administration starts, because it’s easy. It’s also the “yeah, but we don’t have to” conversation from earlier, with a presidential seal on it.

Good rules come from a White House and a Congress that know what the other one is doing, and that listen to the people who build and use this stuff. The midterms may change who sits where. They won’t change that.

None of this is ever finished. The conversation about what kind of regulation never gets a final answer. It keeps shipping new versions, the same way BenchBoard keeps getting updates to fit what coaches and customers actually need.

---

Somebody on the Hook

In 2023, a New York lawyer filed a brief in a lawsuit against an airline. It cited six court cases. None of them existed. He’d used ChatGPT for the research, and when the judge asked to see the cases, he went back to ChatGPT, which assured him they were real. He and a colleague were fined $5,000. The case was Mata v. Avianca, and for about a week it was the funniest story in tech.

Then everybody moved on. The fake cases didn’t.

A researcher in Paris named Damien Charlotin started keeping a list of every court decision he could find that dealt with AI-invented law. In May 2025 the list had about 120 cases. By mid-June 2026 it had passed 1,600, with new ones landing nearly every day. And the biggest group filing them this year isn’t lawyers. It’s people representing themselves. People who couldn’t afford a lawyer and asked a chatbot instead. Picture a tenant fighting an eviction, or a parent in a custody fight, typing their situation into a chat window at midnight and getting back a confident brief full of precedent that never existed. No code. No agents. Just a person asking for help, and a machine that never once said “I’m not sure.”

Here’s what the courts did about it, and I think it’s the best model we’ve got.

Nobody banned AI from the courtroom. The rule that catches these filings is old: whoever signs a court document has always been responsible for checking that the law in it is real. “The chatbot told me” is no more a defense than “my paralegal told me” ever was. So judges started sanctioning the filings, and then they built on it. Hundreds of judges now require lawyers to say when they’ve used AI. Bar associations in California, New York, and Florida put out guidance. Florida’s Supreme Court moved to require that filings verify their citations actually exist. The FTC went after DoNotPay, the self-described “world’s first robot lawyer,” using the same 1914 law it has always used against false advertising. And Utah’s Supreme Court has run a supervised sandbox since 2020 where non-lawyer legal services, tech included, can operate under the court’s eye, because people who can’t afford a lawyer still deserve help, and the answer can’t just be “no.”

Old rules, stretched to fit a new problem. Then adjusted. Then adjusted again.

And there’s still a gap, which is the honest part. The rule works by punishing people after the fact, and it lands hardest on the people who couldn’t afford a lawyer in the first place. The next fix is almost boring: courts already run electronic filing systems, and those systems could check every citation against real case law the moment a document comes in, the way spellcheck flags a typo. Catch the fake case at the door, before anybody gets sanctioned. That’s the next version. There will be a version after that.

Now go back to the man with bromide in his salt shaker. In both stories, the human paid. The lawyer paid a fine. The man paid with three weeks in a hospital bed. The difference is the checkpoint. A courtroom has one built in: a licensed lawyer whose job is to check before anything gets filed, and a judge who checks after. When that checkpoint failed, the system noticed and tightened the rules. At a kitchen table, there’s no lawyer and no judge. There’s a man and a chat window. When nobody is standing between the machine and the person, the duty has to sit with whoever built the machine. Otherwise the only one on the hook is the guy who didn’t know enough to ask, and the company behind the answer gets to point at its fine print.

Jensen’s right. If it’s not safe, don’t ship it. But a promise with no mandate behind it is a hope, and hope has never been a safety plan.

Some companies really do mean it. Anthropic built its misuse detection before anybody told it to. But one company meaning it has never made the next company mean it. That takes a mandate.

And here’s what nobody says out loud: we already live surrounded by mandates, and we barely notice them.

Start with the phone charging on your nightstand. There’s a federal law from 1972, the Consumer Product Safety Act, and the short version is that your stuff isn’t supposed to blow up. If a company learns that one of its products could seriously hurt people, it has 24 hours to tell the Consumer Product Safety Commission. The commission can force a recall, and a company that sits on the news can be fined more than $17 million. That’s why, when Samsung’s Galaxy Note 7 started catching fire in 2016, about a million of them were under a government recall less than a month after the phone hit stores. Samsung had 92 reports of batteries overheating in the U.S., including 26 burns and 55 cases of property damage, fires in cars and a garage among them. By October the recall covered about 1.9 million phones. Samsung and the commission ran that recall together. That’s a company and the government working in tandem, with a law making sure the company showed up.

Now look around your house. Federal rules say the slats on your kid’s crib can’t be more than 2 3/8 inches apart, about the width of a soda can, so a baby can’t slip through feet first and get caught by the head. The cap on the aspirin bottle fights you because of a 1970 law, and child poisoning deaths have dropped by more than 80 percent since.

Nobody calls any of that government overreach. We don’t call it anything. We just plug in the charger.

That’s what good regulation looks like when it works. It’s invisible. Nobody argues about it, because the house didn’t burn down.

So when somebody asks whether I’m for AI regulation or against it, I don’t have a percentage for them. Fifty-five percent regulation makes about as much sense as fifty-five percent of a crib. The question is what kind, and the answer is case by case. A crib needs slat spacing. A charger needs to not catch fire. An agent with delete access needs to ask first. A chatbot answering health questions needs to warn you. Different harms get different rules. And for every one of them, it works the same way it did with the bromide. Paper sets the duty. The spec in the code carries it out.

I’m not a legislator, and those five specs aren’t a bill. They’re a starting point from somebody who uses these tools every day and gets paid to clean up after them. But I’m also a dad, and I know you can’t clean up after the kids forever. At some point they have to learn to pick up their own rooms, or I’m never getting to wash the car in the driveway. That’s why parents make chore rules in the first place. Chore rules exist so kids learn to handle their own messes. AI companies are at that stage right now. Good rules should teach them to clean up after themselves, so guys like me can stop doing it for them.

And good law starts by listening to the people who use this stuff and build with it. When the rules get written, we need a seat next to the lawmakers, the same way veteran parents sit down with new ones holding their first newborn. Nobody gets it right alone the first time.

I’m pro-AI, remember. That’s exactly why this conversation never ends, and shouldn’t.

The health inspector doesn’t read the menu. He checks the fridge, and he comes back next month.

---

Sources: Annals of Internal Medicine: Clinical Cases, via Live Science, Straight Arrow News, and The Guardian (bromide case, including the “such as cleaning” wording the patient reported); Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign” (November 2025); Fortune; Lowenstein Sandler; AI Wiki and ICT Security Magazine (Anthropic’s response to GTG-1002); Vectra AI (Anthropic’s LLM ATT&CK Navigator, June 2026); CNN and Bloomberg Law (Character.AI settlements); Illinois Department of Financial and Professional Regulation; Holland & Knight; eMarketer; National Law Review and Gunderson Dettmer (California SB 243); CFP Board/Investopedia (Pearl.com survey); RMIT University; IT Brief UK and Accountancy Age (Dext accountant survey); Veracode 2025 GenAI Code Security Report; eWeek, YourStory, and MintMCP (Replit incident); TechRadar, Slashdot, and the AI Incident Database (Google Antigravity drive deletion); The Register, TechRepublic, and The New Stack (Amazon Q extension); Cloud Security Alliance, Dark Reading, and CSO Online (slopsquatting research); Cybernews (Unit 42 AgentCore research); Netwrix (Trend Micro MCP data); Docker (s1ngularity); Cloud Security Alliance (BioShocking); BuildMVPFast and SoftwareSeni (prompt injection); Cloudflare (Perplexity crawling, August 4, 2025); CASRAI, American Bar Association, and Linklaters (China’s AI rules); Reuters via Cybernews and Engadget, Scientific American, AFP via The Standard, and the OECD AI Incident Monitor (OpenAI agents and Hugging Face, July 2026); Bloomberg Law (defining “AI” in legislation); American Bar Association and AI Business (Moffatt v. Air Canada); Mata v. Avianca, S.D.N.Y. (2023); Damien Charlotin’s AI Hallucination Cases database, via Vaquill, MSBA, and AFP (court filings count); UNC Law Library (Florida Supreme Court verification order); Gurubase (judicial AI disclosure requirements and bar guidance); Utah Supreme Court Office of Legal Services Innovation (regulatory sandbox); Hinckley Allen, McNees, and Long-Term Wiki (TAKE IT DOWN Act); CBS Sunday Morning, “Extended interview: Nvidia CEO explains why he disagrees with AI warnings” (YouTube, around 4:50), with 36Kr and OfficeChai coverage (Huang interview, September 2026); Dreamforce 2026 conversation with Marc Benioff (full talk, YouTube, September 2026); Reuters via The Star (Huang on Ezra Klein); Davis Polk and Morrison Foerster (FTC Operation AI Comply); Goldberg Segalla and Bloomberg Law (Garcia ruling); Implicator (OpenAI blueprint); AFP via ARY News (Anthropic draft bill); Cloud Security Alliance (state AI bill counts); CASRAI, Implicator, the U.S. Senate Commerce Committee, Broadband Breakfast, and Reason (Senate 99-1 vote, July 1, 2025, and the broadband-funding condition on the moratorium); U.S. Consumer Product Safety Commission (Section 15(b) duty to report; Galaxy Note7 recalls, September and October 2016; crib slat standard; Poison Prevention Packaging Act); Foley & Lardner (CPSA civil penalty maximum); King & Spalding and Secure Privacy (Executive Order 14365 and the DOJ AI Litigation Task Force); Bloomberg Law and Axios (David Sacks on Anthropic, October 2025); Associated Press, ABC News, CBS News, The Hill, and Truthout (White House AI accord, the “voluntary” and “morally binding” descriptions, the accountability question, and the “super intelligence” renaming, September 29, 2026); Gizmodo (the September 2026 renaming polls); The White House, “Ensuring Safe, Secure, and Trustworthy AI” voluntary commitments fact sheet (July 2023).

Note: Survey figures are as reported by the organizations that ran them and use their own methodologies. The Garcia ruling was a decision on a motion to dismiss and was not reviewed on appeal before the case settled.