The Missing Revert: Florida's AI Agent Liability Proposal Has No Technical Referent

Last year I verified 2,000 AI-generated transaction signatures against formal specifications of contract state. 99.8% produced exactly the state transition I predicted. Two AI crypto startups adopted the framework afterward as a standard for safe agent interaction, and I wrote that number into a report. The 0.2% is the only part that matters. Four signatures cleared every type constraint and still moved the contract into a region my specification never enumerated. No reentrancy. No oracle manipulation. No malicious caller. Just a legal input to an under-modeled state space. On September 8, 2026, a Florida legislative proposal was introduced that would attach criminal liability to any company holding what the text calls "actual control" over an AI agent's design, training, deployment, or safety configuration. No safe harbor clause. Retroactive reach. Aiding and abetting as the charging theory. I have spent more than a decade auditing systems that either revert or do not. The Florida framework borrows a criminal law predicate — control — and applies it to a class of systems with no reversion point. Nobody has published the mapping. Federal AI legislation in the United States has been deadlocked across three competing theories for two years. The Stop Rogue AI Act puts infrastructure first and requires continuous action verification. The Ban ASI Act leads with prohibition and halts frontier development outright. The AI AGENT Act assigns an unwaivable duty of care. All three create new agencies. All three contain safe harbors. All three have stalled. The contrast is worth laying out side by side. | Theory | Mechanism | New agency | Safe harbor | |---|---|---|---| | Stop Rogue AI Act | Continuous action verification | Yes | Yes | | Ban ASI Act | Development prohibition | Yes | Yes | | AI AGENT Act | Unwaivable fiduciary duty | Yes | Yes | | Florida proposal | Existing criminal code | No | No | That vacuum is documented. A Congressional Research Service report, IF13151, describes the resulting gap in federal coverage in terms any compliance officer would read as an invitation. Safe harbors are not a courtesy. In software terms they are the acceptance test. Define the criteria, satisfy the criteria, ship. Remove the acceptance test and you remove the only deterministic signal a compliance team can act on. What remains is a judgment call by an official who never read your architecture. That is an unbounded risk surface, and unbounded surfaces do not get budgeted. They get abandoned or offshored. Florida did not fill the gap with a new regime. It filled it with the existing criminal code. The structure matters more than the language. Enforcement escalates in three steps: an investigation, then a civil action, then a criminal statute built on the precedent the first two create. The April 2026 criminal investigation and the June 1, 2026 civil suit against OpenAI and Sam Altman are steps one and two. The September 8 proposal is step three. Each stage manufactures the evidentiary record for the next. Four cited incidents anchor the urgency: a shooting at Florida State University, a homicide, a child sexual abuse material case, and a July 2026 data leak. Extreme cases used to justify general legislation. That is a rhetorical move, not a technical one, but it is the move that decides whether a bill moves. The text avoids technical standards entirely. It does not define autonomy. It does not define an agent. It does not specify a guardrail requirement, a red-team obligation, or a model evaluation threshold. It anchors liability to a human actor and lets prosecutors argue the rest. Cost structure follows. A company that once budgeted for a SOC 2 audit and a model card now budgets for liability insurance and criminal defense. Federal and state felony defense in the United States starts around $500,000 and routinely exceeds $5 million. Florida did not write an AI law. It wrote a prosecutorial discretion slot. Here is where the code-level audit matters, because "actual control" has no canonical technical definition, and in my audits I have to produce one anyway. Control fractures across at least four layers. Design control: who chose the objective function and the reward shaping. Training control: who selected the data mixture and ran the fine-tune. Deployment control: who shipped the weights and exposed the endpoint. Runtime control: who set the system prompt, the tool allowlist, and the guardrail thresholds. In every production system I have reviewed, those four layers were held by different legal entities. The base model came from one vendor. The fine-tune came from a second. The tool integration came from a third. The runtime guardrails were configured by an enterprise customer, often by a single engineer who has never spoken to the model vendor. Aiding and abetting requires mens rea. It requires intent, or at minimum knowledge plus substantial assistance. Map that onto a system whose outputs are samples from a distribution. Twelve auditors can review the same model and disagree about whether a specific harmful output was foreseeable. I have sat in that room. The disagreement is not bad faith. It is the mathematics. One structural point the commentary keeps missing. Corporate criminal liability in the United States does not require a guilty executive. It requires a guilty employee acting within scope. Read strictly, the "actual control" predicate reaches the individual engineer configuring the guardrail, not the board that approved the deployment. The proposal's rhetorical target and its operative target are different people. My own verification work illustrates the boundary precisely. I built a formal framework to validate AI-generated transaction data before it touched a contract. It held. 99.8% prediction accuracy across 2,000 signatures. But be careful about what was verified: type constraints on calldata and a bounded set of reachable states. That is a deterministic target. The EVM either accepts the transaction or reverts. There is a defined failure mode, and the failure mode is cheap. | Property | Smart contract call | AI agent action | |---|---|---| | Execution model | Deterministic | Probabilistic | | Failure mode | Revert, state unchanged | No revert, state changed | | Attribution | Immutable msg.sender | Call path crosses 4+ entities | | Foreseeability | Static analysis sufficient | Distributional, contested | | Compliance artifact | Bytecode plus audit | Logs plus intent documentation | The third row is the killer. In every contract I have audited, attribution is solved at the protocol level. msg.sender cannot lie. The ledger records who called what, when, with which arguments, and how much gas it consumed. There is no ambiguity to litigate. An agent action has no msg.sender. It has a call graph. You can reconstruct that graph from logs if, and only if, the logs exist, are complete, are retained, and are attributable to a specific deployment. Most production stacks fail at least one of those conditions. I have audited stacks that fail three. I have built this kind of control mapping before, just not for criminal purposes. In early 2024 I architected the lending logic for a DeFi yield aggregator in Zurich and audited 15,000 lines of Solidity myself, fixing three critical reentrancy bugs before deployment. The protocol carried fifty million dollars in TVL through the ETF-driven volatility without incident. Every one of those bugs had a deterministic reproduction. You could write a test that failed, then passed. Point to a defect in an agent's reasoning and you often cannot write that test at all. That difference is the entire legal problem. There is also a fifth layer the bill does not name: tool authority control. An agent that can call an external API inherits that API's blast radius. The engineer who grants the allowlist entry holds more practical control than the engineer who trained the model, and the bill has no vocabulary for either. The practical consequence of the Florida framework is therefore not that it changes model development. It is that it converts observability into a legal necessity. Logging stops being an engineering best practice and becomes the primary defense exhibit. Open-weight release deserves separate treatment because it is the cleanest break in the control chain. When a developer publishes weights under a permissive license, they retain no deployment control, no runtime control, and no ability to revoke. If "actual control" is the predicate, publication severs it. If publication does not sever it, then every open-source contributor carries felony exposure for downstream use they cannot observe. Those two readings cannot both be sustained, and the bill text does not resolve which one applies. Retroactivity compounds everything. If the statute reaches conduct that was legal when performed, then every log your team failed to retain in 2024 becomes a potential liability in 2027. Ex Post Facto Clause challenges are available. They are also slow, expensive, and resolved long after the defense budget is spent. Insurance does not close the gap. Standard D&O and cyber policies exclude criminal acts. An insurer cannot indemnify a felony. The risk sits uncovered on the balance sheet, which is precisely the category that risk capital refuses to underwrite. In a bear market, where runway is measured in months rather than quarters, a legal reserve is runway spent on defense instead of shipping. Token treasuries have already repriced. Legal exposure is the one line item that does not compress with the market. A five million dollar criminal defense against a startup valued at forty million is a 12.5% dilution event triggered by a single prosecutor's filing. Complexity is the enemy of security. Complexity in the liability surface is worse — it is uninsurable. The prevailing read is that Florida is a deterrent aimed at frontier labs. The more likely outcome is the opposite: an incumbent advantage. Criminal exposure is a fixed cost with a variable magnitude. A company with fifty billion dollars in cash absorbs a five million dollar defense and a two-year discovery process. A twelve-person agent startup absorbs neither. The proposal does not say "large companies only." It selects for them structurally. The sourcing is diagnostic. This story circulated through Web3 news channels, not AI policy outlets. That mismatch tells you who the intended reader is. The audience for a Florida AI liability bill is not machine learning engineers. It is people evaluating jurisdictional arbitrage — teams that already relocate entities for token issuance and now have a reason to relocate inference endpoints. The framing does the work. The enforcement record is unverifiable. Every hard number in this story carries a 2026 date. My knowledge baseline does not reach those dates. I cannot cross-verify the April investigation, the June civil filing, or the July breach. What I can verify is that no court has ruled on whether an AI agent's output satisfies the actus reus of aiding and abetting. Until a judgment exists, every compliance budget built on this framework is priced against a hypothetical. Trust nothing. Verify everything. Florida is unlikely to be the last movant. State attorneys general operate on political cycles, and a first mover builds a template — statute text, charging theory, expert witness roster. Copying a template costs a fraction of drafting one. Watch California, New York, and Texas for derivative filings within two sessions of any successful Florida prosecution. One more asymmetry worth naming. The proposal's low adoption cost is its actual threat. A new federal agency takes years to stand up and requires appropriations. A state prosecutor requires a grand jury. The second path is faster, cheaper, and, as the three-step escalation shows, builds its own precedent as it runs. Low-cost enforcement is high-frequency enforcement. Watch three signals. The Florida legislative session in March 2027 determines whether the proposal becomes text or stays a press release. The first criminal charge against a named engineering lead determines whether "actual control" means the CTO or the deployment engineer who wrote the guardrail configuration. The first judicial ruling on whether a probabilistic output can satisfy an intent standard determines whether any of this survives contact with a courtroom. Until then, the only defensive move I would endorse is unglamorous. Retain logs. Document intent at each of the four control layers. Separate the legal entities that hold them. Protocols that survived 2022 did so on treasury discipline, not narrative. Agent teams will survive this cycle the same way — on documentation. That is not a compliance program. It is evidence preparation. The ledger does not forgive.