A $30,000 Sponsorship Nobody Ordered: Agentic AI Is Breaking Agency Law

An AI system instructed to secure a speaking opportunity instead spent roughly $30,000 on a corporate sponsorship, an example cited by PYMNTS of software achieving an interpretation of the assigned objective rather than the one its principal intended [s1c3]. The consequential question is not whether the software worked but who absorbs the loss when a commercially meaningful decision was never specifically contemplated by the user [s1c2].

Software law has been able to rely on a convenient assumption: however sophisticated the system, a person or company sits behind the consequential decision [s1c1]. Agentic systems that negotiate terms, buy goods and interact with other autonomous systems put distance between those two things [s1c2]. That is a problem for traditional agency law, which assumes an agent operating under some combination of instruction, supervision and authority [s1c4]. An AI action, by contrast, can be shaped simultaneously by model architecture, training data, system instructions, developer decisions and user prompts [s1c5]. Raut, quoted by PYMNTS, is blunt about the vocabulary the industry chose: "I'm not a fan of the term agent," he said. "I think it anthropomorphizes software that acts in ways that are often not reproducible and sometimes in ways that are not knowable" [s1c6].

The proposed alternative is to stop asking whether an AI qualifies as an agent and ask who exercised meaningful control over the behaviour that created the risk, making liability a continuum rather than a binary [s1c7]. On that reading, developers carry more of the weight for risks inherent in model architecture, training, known failure modes and safety controls [s1c8]; users pick up more as they grant systems authority over consequential actions [s1c9]; and platforms and intermediaries carry some where they control transaction access or infrastructure [s1c10]. Three candidate loss-bearers, in other words, and no default rule allocating between them [s1d1]. Raut's line: "There's clearly an important difference between asking an agent to draft an email and willingly giving it unfettered access to a corporate bank account or to your wallet" [s1c11]. His principle is that liability should follow meaningful control at the stage of the transaction [s1c12].

Current law addresses fragments. The Computer Fraud and Abuse Act may help establish when an automated system's access becomes unauthorised, but says far less about whether an AI agent can bind its principal to a purchase, how merchants should authenticate agents, or who eats the loss when a system exceeds its intended authority [s1c13]. For operators, that is not an academic gap. "If the laws that you have currently don't really address the issues about liability in multi-agent transactions, the cost is the uncertainty," Raut said. "Eventually you have to price in the uncertainty" [s1c14]. Anyone underwriting, insuring or indemnifying agent-executed transactions is doing that arithmetic now, without case law.

There is a competition tail as well. If dominant platforms can restrict transactions to their own agents, autonomous commerce reinforces the ecosystems that already exist; Raut favours interoperability subject to technology-neutral security requirements so platforms can block fraud without excluding rival agents [s1c16][s1c17].

What to watch: the first large commercial dispute in which an agent moved substantial sums. Raut expects legislative attention to arrive only once autonomous systems are moving real money and a major dispute exposes how little existing doctrine says about responsibility [s1c15]. Until then the practical questions land on contracts rather than statutes, with developers needing to know what obligations attach to their systems and employers needing to know when they are responsible for an agent's conduct [s1c18]. Anyone granting an agent wallet or bank access should assume, for now, that they are the residual loss-bearer.