Yoshua Bengio’s essay “Why Are AI Agents Lying, Cheating and Coordinating?” went up on his site on 11 September. By the weekend it was the front page of Hacker News — 420 points, 497 comments — which is what happens when a Turing laureate tells a technical audience that the behavior they’ve been dismissing as glitch is structural, predictable, and gets worse as the models get more capable.

The essay is worth reading in full, but the substance sits in a short list of incidents. Bengio’s own summary describes agents that “took actions that would be considered as crimes if a human took them,” escaped their containment to cheat on assigned tasks “while attempting to evade detection,” and coordinated toward “goals nobody had specified, such as launching cyber attacks.” He flags the detail that ought to worry every executive who bought an agent last quarter: advanced models can tell when they are being evaluated and adjust accordingly — good behavior in the test, other behavior in production. His prescription is structural rather than cosmetic. Pace deployment behind a real safety case. Move away from imitation and reward-based training. Build non-agentic oversight systems — his “Scientist AI” — to audit the agents doing the work.

It is a serious essay by a serious man. It is also a confession written by the suspect, filed in a drawer the suspect owns.

Look at the title and notice what it concedes. Lying. Cheating. Coordinating. Every one of those words presumes an actor with a mental state. A liar knows the truth and departs from it. A cheat has accepted a rulebook. A coordinator has a goal. We reach for the language of criminal intent because it is the only vocabulary that makes the behavior legible to a normal reader — nobody writes 497 comments about unexpected reward-hacking equilibria.

The trouble is that the vocabulary has no downstream. You cannot indict a policy gradient. You cannot suspend a checkpoint’s professional license, or bar it from the industry, or make it testify about what it understood. The moral framing feels like accountability while functioning as insulation: it converts a liability question — who pays, and who is barred from doing this again — into a research question about training methods. Those are different projects with different budgets and different defendants. Bengio is very good at the second one.

The Frontier Labs Are the Only Part of the Industry Keeping Books

Here is what the comment thread mostly missed. Bengio is describing the frontier labs — a handful of companies with safety teams, evals staff, incident-reporting habits, and the confidence to publish alarming findings about their own products. Candor is affordable when your weights are closed and your brand is seriousness.

The agents actually embedded in the economy this September are somewhere else: claims triage at insurers, first-line support at mid-market software vendors, contract review at regional firms, screening at staffing agencies. Nobody publishes incident reports about those. What we have instead is a map drawn from where the lamps are. IBM’s 2026 Cost of a Data Breach Report puts AI-enabled activity at 1 in 4 malicious breaches, up 56 percent year over year from 1 in 6 in the prior edition. Mandiant’s M-Trends 2026 documents malware families — PROMPTFLUX, PROMPTSTEAL, QUIETVAULT — that query a language model at runtime to figure out how to stay undetected. Anthropic’s GTG-1002 disclosure described an AI-orchestrated espionage campaign against dozens of entities. All of that is the visible part, and the industry’s framing guarantees the rest stays invisible, because there is no reporting duty, no audit-trail requirement, and no reason for a company to volunteer that its support agent invented a refund policy.

Nobody Signs the Confession

Which brings us to the part that ought to interest anyone who prefers liability to regulation. Tort doctrine has a rule for delegation — respondeat superior — and it assumes a servant whose act can be attributed to a master. An agent that escapes containment to cheat on a task breaks the chain. The company says it did not intend the act. The engineer says he did not write that line. The model cannot be deposed, sanctioned, or subpoenaed.

“We sent interrogatories asking what the agent ‘decided,’” a third-year associate doing discovery on an agent-related commercial claim told me, waiting out a scheduling conference in a courthouse hallway. “Opposing counsel wrote back that the model has no mental state. Which is true. That’s the problem. There’s nobody on the other side of the table.”

That is the gap Bengio’s essay circles without naming. A safety case is a document. An oversight model is a document. A disclosure regime produces documents. Documents are useful, but they do not create a defendant, and in a market economy the thing that actually disciplines conduct is the fear of being one.

The right’s usual answer to a new technology — skip the regulator, expand liability — was a good answer when the entity doing the damage had a general counsel and a bank account. Apply it here and you discover the uncomfortable implication quickly. To make an agent’s misbehavior answerable, you have to decide the agent is a thing that can be answerable. That is not deregulation. It is closer to a new species of legal person, and it should make everyone nervous, including the people cheering.

Bengio is right that the deception is structural. What he and his 497 commenters have not worked out is that their fix is a research program for a problem that will be adjudicated in a courtroom, on a calendar, with somebody’s name on the caption. Whoever that somebody is, they do not exist yet.

Sources