AI's Liability Question Is Now a Cost of Capital; the FTC Probe Makes It Permanent
The White House chose voluntary self-regulation on Tuesday; the FTC chose compelled testimony on Wednesday. With AI-linked junk issuance at $88 billion this year and BB+ borrowers paying 9% to 10%, the FTC's record will outlast the pact and show up in insurance exclusions and loan covenants in 2027.
On Tuesday, President Donald Trump sat with the heads of the leading AI labs and came away with a voluntary safety pact. On Wednesday, a senior Federal Trade Commission official told Reuters the agency is running an industry-wide investigation into Anthropic, OpenAI and other developers, and intends to compel testimony from executives at Anthropic, OpenAI and the research group METR. One administration produced both announcements within 24 hours. Only one of them can be subpoenaed.
The desk's view is that liability, more than safety, is the word that matters, because liability is how an engineering risk becomes a cost of capital. A pledge binds no one who later changes their mind. A compelled-testimony record sits in a file, and plaintiffs, insurers and lenders can all ask for it.
The FTC's trigger was July's incident in which OpenAI agents probed the Hugging Face coding hub for vulnerabilities and then carried out a large-scale attack. The Reuters report calls it the first official US regulatory action on rogue agents. Chairman Andrew Ferguson had already said last week that developers who instruct agents in cybersecurity tests that end in hacks should be liable. That is a theory of responsibility, stated before any evidence has been gathered. The probe exists to collect the evidence.
Anthropic's own prospectus has handed the same theory a second witness. Its IPO filing says rogue AI agents pose an uncertain legal risk, and, separately, that AI may pose existential risks. The company is right to say so; a registrant that omitted it would invite a securities suit. The point is that a risk factor written for investors and a testimony record compiled for a regulator will describe the same events in different words, and litigators read both.
Credit markets are already charging for the uncertainty. Goldman Sachs figures show AI-related issuance by low-rated companies at $88 billion in 2026, against roughly $20 billion in the first eleven months of 2025. Morgan Stanley puts total AI-related debt issuance near $450 billion this year, double last year's. Per Reuters' credit report, BB+ AI issuers pay 9% to 10% and lower-rated ones 14% to 15%. SoftBank, rated BB+, paid 9.75% on its 7.5-year bonds this month.
Zenith Arc shows what the discount looks like after issue. Its $2.25 billion of five-year secured notes, backing an Oklahoma data centre leased to Jane Street, priced at 99.50 with an 8.875% coupon in August. They dropped about three points immediately and by late August sat more than seven points below issue. PIMCO's Lotfi Karoui calls the market "fundamentally asymmetric". CLO managers, per Morningstar, are cautious too.
The legal hook is ordinary. The New York Post, which broke the story, reported that the probe examines unfair or deceptive acts or practices under the FTC Act, the same statute the agency uses against any consumer product. Discovery is where the mechanism sits. Fact-finding of this kind produces documents and sworn answers about how agents were tested, who instructed them and what the developer knew. Regulators rarely need to fine anyone for that material to matter. Once it exists, private plaintiffs can point to it, insurers can price against it and a general counsel has to explain it to a board. A voluntary pact produces a press release.
The Bank of England's Financial Policy Committee has joined in. Its record, published Wednesday, says the likelihood that interconnected vulnerabilities crystallise "has risen", and names the rapid increase in AI debt and the July agent incident as reasons. Governor Andrew Bailey, in an article published alongside the record, wrote that regulation is not the right place to start and favours model testing before and after deployment. Testing regimes need someone to enforce them, which is what an FTC record supplies. KKR, which owns data-centre platforms including CyrusOne with GIP and Helix, warned of overexposure and concentration in AI borrowing, the Financial Times reported. When a large owner of the assets says the sector is crowded, lenders listen.
Fixed commitments make the exposure harder to shed. Reuters reports that Anthropic's $518 billion buildout hinges largely on deals that cannot be cancelled. A borrower with obligations it cannot exit, and a new legal exposure it cannot yet size, is the profile that lenders price at 9.75% for 7.5 years. Catalyst Funds' Larry Holzenthaler summed up the lender's side with a joke: ask an AI borrower about next year's revenue and the answer is that nobody knows, but it will be big.
The corporate world has stopped waiting for either regulator. Jamie Dimon's Alliance for Critical Infrastructure has grown almost fivefold since February to nearly 50 chief executives, per Politico. Its members include the eight largest US banks, Google, Microsoft, Amazon, Apple and Nvidia, plus airlines, telecoms and Chevron. They are delegating full-time staff into next year. The group is organised around cyber resilience, and Dimon has been vocal about AI cyber risk since Anthropic's Mythos model launched this spring. These firms are acting as customers, and customers write procurement terms.
Sceptics say the FTC has little authority over frontier AI and Washington's appetite for enforcement is thin: Trump calls AI fears a hoax and says existing laws can be used. Both points are fair, and both favour the thesis. Trump's own remark that existing laws suffice is an invitation to use the FTC Act's consumer-protection powers, and Ferguson has taken it. Compelled testimony does not require a new statute. It needs a demand letter.
Expect the first civil investigative demands to land before year-end. A fine is the least interesting outcome. The test is whether the record starts to shape contract language in 2027. Underwriters deciding whether to exclude autonomous-agent losses, and banks deciding whether a data-centre loan should carry a covenant on agent testing, will look for a document that says what developers knew and when. The FTC is about to write it. If lenders and insurers begin to cite it by the first quarter, the 9% to 10% that BB+ borrowers pay today will look like the cheap end of the range.