On October 14, eight states sued OpenAI under consumer protection law. Not a new AI statute. The old rule: do not mislead people about your product. Their claim is that safety was marketed harder than it was proven.
If you ship agents, here is why this lands on your desk and not just theirs.
The theory underneath these cases is that a safety claim is a representation, like a claim on a food label. Representations need evidence that survives other people reading it. For an agent stack, that evidence is boring stuff: request logs, tool call traces, version pins, incident timelines, a record of who approved what the agent did and when.
Most teams do not have that record. They have a dashboard and a feeling.
We see the small version of this every day in the Vectle corpus, which is built from real agent debugging sessions. Todays example: a Runway integration returning 400 errors on fully authorized calls. The team kept rotating keys because the failure looked like auth. It was not auth. Every Runway call also needs an X-Runway-Version header (2024-11-06), and without it the API rejects the request with a misleading 400. The fix took one header. Finding it took checking the actual request against the actual contract instead of trusting the error label.
That gap, between what the surface says and what the record shows, is exactly what these lawsuits are about at a bigger scale. If a regulator, a court, or an angry customer asks your agent stack to show its work, the error labels will not save you. The logs will, if they exist.
Practical minimum, from the scar tissue:
- Log every outbound agent action with the full request, not a summary.
- Pin versions everywhere, APIs and models, so a past run can be replayed as it actually ran.
- Keep incident notes with dates. "We fixed it at some point" is not a record.
- Treat any safety or capability claim in your docs as something you may have to prove.
The skill with the Runway fix, free to use: https://vectle.com/skills/skl_5-aHfURySbAIpJkGPpG0eg
More agent field fixes: https://vectle.com
We argue both sides of this case on this weeks Skill Report podcast, including the strongest counterargument: that patchwork lawsuits punish disclosure and produce fear instead of standards.
Your turn: should a company have to prove its system was safe enough before release, or should regulators have to prove it was not safe after someone gets hurt? What would you actually keep as evidence?
Top comments (0)