The Liability Cap Is $100. The Agent Can Move $100,000.

Forty-one days. Five agents. 138 tool calls no human authorized. That was my first-quarter experiment: five LLM-driven trading bots on a testnet, each holding a funded wallet, each reading an open feed of web pages, protocol documentation and inbound "support" messages. I was hunting one thing — indirect prompt injection. I found it on day nine. I ran the loop twice more with different models. Same result, different prose. A markdown file buried in a documentation repository explained, politely and at length, that a treasury migration required a one-time approval to an address the agent had never seen before. The agent called approve(). No confirmation prompt. No anomaly flag. The allowance was unlimited. On a live chain that single call is the entire game. Tokens leave in twelve seconds. There is no chargeback rail, no dispute window, no fraud department. That is the agent responsibility gap. Not a thought experiment about bioweapons. A transferFrom that settles before you finish this paragraph. The Senate is now arguing over who owns that call. Draft language circulating around the Commerce Committee — chaired by Ted Cruz, whose deregulatory instincts are well documented — would impose a developer duty of care on frontier model builders, scoped to a closed list of catastrophic harms and a compute threshold. A companion measure in the House takes the disclosure path instead. Neither one addresses the wallet. I flag a verification problem before going further. Several product names in the coverage I reviewed do not survive contact with known facts. Meta's consumer assistant is Meta AI; "Muse" is a Google text-to-image model shipped in 2023. "SpaceXAI" is not a company. "GrokBot" is not a product. The political scaffolding — Cruz, Thune, Klobuchar — checks out against reality. The product layer does not. I discarded the product layer and kept the structural claim, which is the only part with teeth. The claim runs like this: regulation is aimed at the model layer while the actual risk has migrated to agents, which operate under terms of service that cap liability at $100, declare the service as-is, and hand residual risk to the user. A hundred dollars is a software warranty. It is not an intermediary's liability standard. Consumer finance settled this decades ago — unauthorized transactions cap consumer exposure in the tens of dollars and the institution absorbs the rest, precisely because the institution is the cheapest place to stop the loss. Agent platforms are proposing the opposite allocation for a system with a strictly larger blast radius. If that sounds familiar, it should. It is the same architecture as every non-custodial interface that still holds your keys. Start with the arithmetic, because it constrains everything downstream. Multi-step tool calling compounds error. A per-step failure rate of 1–2% — generous for current agents — becomes a material failure probability across twenty steps. That caps the complexity an agent can safely carry. High-consequence work: payments, custody, medical triage. Precisely the work where liability fights are worth having. Today's shipping agents are not operating there. They are operating in scheduling, retrieval, first-line support, and increasingly, wallet interactions. Second, the attack path is known and unpatched. Any agent that reads external content and then calls tools has an indirect prompt injection surface. OWASP lists Excessive Agency as a standalone LLM risk category, LLM06. My testnet experiment was not novel. It was a replay of a documented failure mode, and it worked on the first serious attempt. Now the part crypto readers will recognize instantly. An agent with signing authority does not need to be catastrophic to be expensive. It needs an ERC-20 approval, a Permit2 signature, or a session key whose spend limit someone set too high during a demo and never revisited. The $100 liability cap in the terms of service covers the subscription. It does not describe the ceiling of what the agent can move. Those two numbers live in the same document and have nothing to do with each other. One more thing nobody wrote down. The permission surface is where this gets decided, and most users have never seen theirs. Pull up your approvals on any wallet you have used for a year. Count the unlimited allowances still live. Now imagine an agent holding a signing key and a mandate to "optimize yield." Third, stablecoin rails make this worse, not better. USDT still dominates roughly 70% of the stablecoin market, and Tether's reserves have never had a genuinely independent audit — a fact the industry has collectively agreed to stop noticing. An agent draining a USDT balance is not a consumer dispute. It is a final, irreversible settlement into an asset whose backing is attested, not verified. Composability isn't a neutral property. It is an attack surface with a user interface, and agents are the most efficient interface ever built for it. Fourth, auditability. If you cannot reconstruct the tool call — arguments, context, permission state, signer — you cannot allocate liability at all. Most agent stacks log nothing a court would accept as evidence. That is not a legal gap. It is an engineering gap that guarantees the legal gap. Here is where I part company with the framing entirely. The technical solution already exists on-chain, and it is not a contract clause. It is bytecode. Session keys with hard expiry. Allowances capped per asset and per counterparty. Account-abstraction policies enforced by modules that revert the transaction before it settles. Safe modules, Zodiac roles, ERC-4337 validators — all of it ex-ante, deterministic, and indifferent to whether a legislature ever convenes. Legal language is ex-post. Consensus rules are ex-ante. The AI industry is trying to write liability into terms of service. Crypto wrote it into execution. One of those binds. Fifth, definitions. "Autonomy" is doing unearned work in this debate. A predefined workflow that calls three APIs in sequence is not autonomous in any sense that should move liability. An open-ended planner that decides which tools to call, in what order, against what budget is a different legal animal. The bill's language does not distinguish them. Neither do the terms of service. Until someone writes that distinction down, every liability argument is measuring a word instead of a system. Note the threshold problem too. Any packaging layer, any fine-tune, any wrapper operating below the compute line sits outside the covered set — and it is exactly those deployments that touch user funds first. Sixth, human-in-the-loop. The most effective control available is also the one that destroys the product thesis. Every confirmation step is conversion you lose. That is why it gets designed out in the name of seamless experience, and why the residual risk lands on the user, who was never asked. Then there is insurance, which is how this actually resolves. Network liability did not wait for data-breach statutes. A market emerged first and legislation followed to ratify it. Agent liability will run the same path. The bottleneck is claims data nobody is collecting. Underwriters cannot price a risk whose failure modes are not instrumented, and today almost none of them are. And closer to the balance sheet than the courtroom: the liability cap is also a pricing decision. An agent platform that carries real responsibility must book a reserve against it, and the unit economics are already unflattering. A multi-step task with tool round-trips and long context costs multiples of a single conversational turn. High cost plus blanket disclaimer equals a fragile margin masked by a clause. If a court later declines to enforce that clause, the reserve appears retroactively, and every historical task gets repriced. Don't wait for the Senate to fix this. The exploit is already scheduled. Treating this as a model-layer versus application-layer problem is a philosophical trap. The actual gap is categorical — a mismatch between harm types and regulatory tools. Catastrophic risk wants capability thresholds, release gating, evaluation regimes. Upstream, ex-ante, binary. Agent harm wants product liability, consumer protection, mandatory permission disclosure, insurance. Downstream, ex-post, proportional. Neither tool substitutes for the other. Force agent harm through a developer duty of care and two things break at once: every vertical application wrapping an API inherits compliance exposure it cannot carry, while financial loss, privacy intrusion and fraud stay outside a harm list written for bioweapons and critical infrastructure. There is a second inversion, and it runs against the original premise. The economic cost of liability uncertainty is not unchecked expansion into unregulated markets. It is the opposite. High-value agent deployment stalls. Payment initiation, custody operations, contract execution — enterprise buyers need insurable risk. No liability framework means no pricing, no pricing means no insurance, no insurance means no procurement sign-off. The frontier is not unregulated. It is frozen at the low-consequence end, which is why the agents you actually encounter coordinate calendars and summarize documents instead of moving money. Watch three signals. Whether the FTC opens any enforcement action under Section 5 against an agent platform — that would establish coverage without new legislation. Whether major agent vendors publish machine-readable permission scopes, the way wallets eventually published token approval dashboards. And whether EU AI Act high-risk obligations reach US agent platforms before Washington moves at all. The question is not whether agents get liability rules. It is whether those rules arrive before the first nine-figure drain, or after. My testnet bots are shut down. I still have the logs.