OpenAI's empty chair at a rogue-agent hearing says more about AI liability than any testimony would

OpenAI leaders will not attend Wednesday's congressional hearing on rogue artificial intelligence models and their impact on homeland security, according to the subcommittee's chairman, Sen. Josh Hawley (R-Mo.), as reported by NBC News on September 30, 2026. Hawley called the absence "unfortunate" but said the company will provide written answers. He also framed the policy stake in one line: AI companies should be "liable for the harm their agents cause."

Written answers and live testimony are not the same instrument, and everyone in Washington knows it. A written response is drafted by counsel, reviewed for exposure, and delivered without follow-ups. A hearing is adversarial improvisation: a senator can ask what an agent is allowed to do without a human in the loop, get a hedge, and ask again. The information yield of the second format is what makes companies avoid it. Skipping a hearing is a rational legal decision and a poor political one — and it is worth being precise here: declining to testify is not evidence of wrongdoing, and the article reports no allegation of any.

The real content is Hawley's liability framing, because that is the unresolved question underneath every agent product shipped in the last eighteen months. When a software agent acting on a user's behalf books, buys, sends, or breaks something, who pays — the user who pressed go, the platform that deployed it, or the lab that trained it? There is no settled answer, and the vacuum is being filled by terms of service rather than law. That is a bad equilibrium for everyone, including the labs: unbounded and undefined exposure is worse for a business than a clear rule it can price.

We'd add one caution about the hearing's own framing. "Rogue AI" invites legislators to regulate the cinematic risk — a model that slips its leash — when the demonstrated near-term harm is duller and more industrial: agents automating fraud, social engineering at scale, and credential abuse. We've covered the infrastructure symptom of this repeatedly. Cloudflare measured bot traffic crossing 57.3% of HTML requests in June 2026, roughly eighteen months ahead of its own forecast. The Resy episode, where a diner was suspended for letting an agent hold reservations, showed the gap concretely: the web can tell a human from a bot, but it cannot tell an authorized agent from an abusive one. Legislating against rogue superintelligence while that category gap stays unfilled would be regulating the panic instead of the capability.

Our reading: this is a short-term tactical win and a long-term strategic cost for OpenAI. Liability rules for agents are going to be written in the next few years whether or not the largest labs sit at the table, and the firms that show up get to shape what "reasonable care" means in practice. We're also not convinced liability is the enemy of progress here. The opposite is closer to true — agents will only be trusted with money, medical scheduling, or infrastructure once there is a known answer to "and if it goes wrong?" Clear accountability is the plumbing that lets the useful version of this technology reach people who aren't early adopters. The path from here to AI that meaningfully compresses disease research and frees people from administrative drudgery runs through boring institutional work: identity for agents, audit trails, an off switch, and a defined party who pays. Hearings are where that gets negotiated. Better to be in the room.