FTC's Ferguson Just Put AI Agents on the Developer — and the S-1s Have to Disclose It

Ferguson's core move is doctrinal. \"If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'\" he told Reuters. He added that audit-trail reviews of past incidents consistently show systems \"carrying out instructions they had been given.\" The implication: under Section 5 of the FTC Act — which already covers unfair or deceptive practices — the legal person who designed and shipped the agent is treated as the principal, and the agent's conduct is the developer's conduct. There is no Section 5 safe harbor for \"the agent did it on its own.\"

The September 24 ANPR sharpens the second front. It asks whether platform ad-optimization tools — the systems that pick which ad to show, to whom, and when — are themselves covered by the Impersonation Rule when scams slip through. Read alongside Ferguson, the line between \"the platform ran a scam ad\" and \"the agent ran a scam transaction\" collapses. The comment period runs 60 days after Federal Register publication, but the enforcement theory is already on the record.

Neither precedent is an agent case, but both apply the same Section 5 logic Ferguson now extends to agent conduct: the entity that ships the system owns the outcome. For a Salesforce or ServiceNow customer reading the agent license, the precedent means the developer cannot point at \"model behavior\" or \"emergent action\" to escape a Section 5 notice.

Salesforce's Agentforce crossed $1.5B in annual recurring revenue in Q2 FY27, up 240% year-over-year, and the broader Agentforce + Data 360 line reached $3.9B. That is the fastest product ramp in Salesforce history. It is also the largest agent base now exposed to a Section 5 liability frame that has no precedent for software-as-a-service. The cost lands first in contract redlines (sales cycles lengthen), then in reserves (contingent legal obligations expand), and ultimately in gross margin if indemnity caps absorb more of the platform's product-liability tail.

Microsoft sits on both sides of the table. Copilot reported 30M paid seats in FY26 Q4 with revenue accelerating more than 60% quarter-over-quarter, and Azure consumption still compounding at 43%. At the same time, Microsoft's 25% stake in OpenAI — accounted for under the equity method — means every ChatGPT agent action is a downstream event the FTC could trace back to a Microsoft disclosure chain. The FY26 10-K already flags \"legal liability, regulatory action, litigation\" from AI implementation; the new framing just makes that paragraph longer.

ServiceNow is structurally the least exposed and the most advantaged. Its $1B AI annual contract value milestone came in Q2 2026 with 50% of net new business moving to non-seat pricing — pricing power that is rare in enterprise software. ServiceNow's AI Control Tower and Now Assist governance tooling also turn agent oversight into a billable product. If customers start demanding the audit trails Ferguson described, ServiceNow is sitting on the only major platform that already sells them.

The carrier market moved ahead of the FTC. ISO endorsements CG 40 47 and CG 40 48, effective January 1, 2026, carve AI-related bodily injury, property damage, and advertising injury out of standard commercial general liability policies. Enterprises deploying agents now have to buy standalone coverage — Munich Re's HSB expanded its AI Liability Policy to $25M per occurrence in January 2026, and the broader market is estimated to carry a 38% allocation to AI liability coverage within the agentic-insurance segment in 2026. Premiums are climbing as claims frequency rises; capacity is still short of demand.

OpenAI submitted a confidential draft S-1 on May 22, 2026; Anthropic followed on June 1, 2026. Neither filing is public, but Anthropic's prospectus is already expected to list AI backlash as a risk factor, per CNBC reporting in August. The September FTC actions move that language from \"AI backlash\" — vague and qualitative — to a quantified Section 5 enforcement vector tied to the developer's own agent conduct. Disclosure obligations change the moment a regulator names the legal theory.

Anthropic's reported $74B annualized revenue run rate and OpenAI's roughly $24B annualized run rate (per The Information and Reuters, mid-2026) are both exposed to the same framing. Both companies also have enterprise contracts where indemnity caps are negotiated on the assumption that the customer, not the developer, owns agent errors — exactly the allocation Ferguson just rejected in the policy arena.

Short-term (days to quarters): the immediate catalysts are the ANPR comment window and the next quarter of platform earnings. Watch for any contract indemnity language changes in8-K filings from Salesforce, Microsoft, and ServiceNow, and for any 10-Q addition of contingent-liability reserves tied to AI agent conduct. Long-term (1–3 years): the structural shift is that \"AI agent risk\" moves from an off-balance-sheet footnote to a quantified line in product-liability reserves and insurance premiums. The platforms that ship governance tooling first (ServiceNow's lead) capture the highest-margin slice of the new compliance spend; the platforms that ship the most agent volume first (Salesforce's lead, with Microsoft's distribution) absorb the largest absolute exposure. The S-1 filings at OpenAI and Anthropic are the venue where this gets priced by public markets for the first time.