On September 8, the Florida Attorney General's office moved to make software criminally liable. Not the user. Not the operator. The system. The proposal would let prosecutors charge the people who designed, trained, deployed, and controlled the safety settings of an AI system — the so-called "practical control" layer — as principals in crimes executed through that system. The supporting evidence trail cites 17,600 unauthorized operations tied to a single agent deployment.
Crypto watched a sideways tape all week and missed it. That is a mistake. On-chain autonomous agents now rebalance treasuries, execute hedges, manage LP ranges, and cast governance votes with wallets no human touches between blocks. The moment a state defines "practical control" as the legal fault line, every multisig signer, DAO delegate, and agent framework operator becomes a defendant in waiting.
The question is not whether Florida can write this statute. The question is who, on-chain, actually holds control — and whether the chain's own evidence trail convicts them or clears them.
Context: the escalation ladder nobody priced
The Florida framework did not appear from nothing. It arrived at the end of a three-step escalation that reads like a legal pressure test.
First, an April 2026 state investigation into an AI system's role in the FSU shooting. Second, a June 2026 civil action naming OpenAI and Sam Altman directly — a move that shifted the argument from product liability to personal accountability. Third, the September criminal legislation itself, which adds what the drafters call a "fourth theory" on top of the existing three pillars of transparency, data, and safety standards. That fourth theory is results-based criminal accountability: you are judged by what the system did, not by whether you filled out a compliance form.
The penalty menu is the tell. Fines and forced restitution are ordinary. Court-appointed monitorship is invasive. But post-conviction suspension of business operations is a binary outcome — alive or dead — and binary outcomes cannot be priced with expected-value math. You cannot budget a survival threat the way you budget a percentage-of-revenue fine.
For the crypto industry, the timing is brutal. The on-chain agent sector spent 2025 and 2026 racing to ship autonomy: delegated execution, treasury bots, strategy vaults that call other protocols without human sign-off. That race assumed the only risk was technical. Smart contract bugs. Oracle manipulation. Slippage.
Nobody priced a prosecutor.
I have audited enough code to know where the exposure sits. In 2017, during the ICO sprint, I pulled apart twelve flagship contracts and found three with vesting schedule logic that contradicted the whitepaper. The lesson then was the same lesson now: the gap between what a system is documented to do and what it can actually do is where liability lives. Florida is proposing to criminalize that gap.
Core: where "practical control" lands on a public chain
Start with the doctrine, because it determines everything downstream.
Aider-and-abbettor theory is old law. A person who helps another commit a crime, with knowledge and intent, becomes a principal. The Florida draft extends the frame: an AI system that facilitates a crime is treated as an agent, and the humans who exercise practical control over that agent inherit the principal role. Four control points are named — design, training, deployment, safety configuration.
Now map those four points onto an on-chain agent.
Design: the framework author. Often a pseudonymous team that forked an open repo and shipped a modified execution loop.
Training and configuration: the operator who sets the risk parameters, the guardrails, the allowed counterparties.
Deployment: the entity that funds the wallet and signs the initial approval.
Safety settings: the multisig that can pause, upgrade, or revoke.
Every one of those is a distinct legal actor. On a public chain, they are also distinct addresses. That is not a detail. That is the entire case.
The evidence trail is the strongest in existence — and it cuts both ways
Here is the uncomfortable asymmetry. When I reconstructed the FTX collapse in 2022, I did not wait for press statements. I went to the Solana ledger and located roughly $1.2 billion in transfers to Alameda-linked accounts inside 48 hours. The chain does not require a subpoena to tell the truth. It is already public, already timestamped, already immutable.
Apply that to agent liability and the picture splits.
For prosecutors, on-chain agents are the easiest defendants in history to build a case against. Every action has a transaction hash. Every parameter change has a block number. Every deployment has a deployer address, a funding source, and often a cluster of related wallets. In 2021, I traced three coordinated wash-trading operations back to a single entity using nothing but wallet clustering across Ethereum and Polygon. The same method that exposed market manipulation exposes agent intent.
For defendants, the same trail is a shield. A logged, versioned, immutable record can prove that a guardrail existed, that an operator was unaware, that a compromised key — not a human decision — executed the transaction. On-chain transparency is not pro-prosecution or pro-defense. It is neutral and total. Whoever reads it first wins.
That flips the incentive. Compliance becomes an engineering problem: build agents whose decision chains are legible, whose safety settings are versioned, whose pause authority is documented. The protocols that already do this for security reasons get a legal dividend for free.
The mens rea gap: code doesn't intend
Now the part the headline writers skipped.
Anglo-American criminal law requires intent. A principal must have meant to do the thing. Software has no intent. It has determinism. A smart contract that executes a swap does not want anything. It evaluates a condition and moves state.
Any competent defense lawyer will drive a truck through this. The statute says judge the system by its words and actions, and place it in the agent position. But an agent that cannot form intent cannot supply the mens rea that a principal role requires. The workable path — the one the bill's rhetoric obscures — is not to treat the AI as a legal person. It is to attribute the system's conduct back to the intent of its human controller. That is ordinary agency law wearing a futuristic costume.
Which means the bill is less legally novel than its framing suggests, and the real fight is over one word: knowledge. Did the controller know? Should they have known? Is negligence enough, or does the state need actual intent?
That distinction is the whole ballgame for open-source. If the standard slides to negligence, then every deployer of a permissionless framework inherits liability for uses they never saw coming.
Fixed compliance costs are a scale moat — I have seen this movie
Compliance is a fixed cost. Legal review, security audit, evidence retention, liability insurance, monitor response — none of it scales down for a two-person team.
I watched the same mechanism in DeFi in 2020. I scraped early governance votes, cross-referenced them against Uniswap liquidity pools, and published an exposé on twelve protocols running unsustainable emissions. The ones that died fastest were not the worst-designed. They were the smallest. Fixed overhead — audits, legal wrappers, insurance — ate them before the token chart did.
Florida's framework adds a new fixed overhead to the list. The net effect on any AI or agent sector is structural: raise baseline cost, and you favor whoever can amortize it. Large labs with standing legal teams absorb it. Open frameworks and small deployers cannot.
For on-chain agents specifically, the consequence is severe. Open-source model publishers have diffuse control and invisible downstream fine-tuning. "Practical control" is theoretically undefined for them. If courts stretch the standard, publishing a framework becomes an uninsurable act. That is a structural short against the entire permissionless agent thesis.
Geofencing: state-by-state liability reproduces money-transmission Balkanization
Crypto already solved and then unsolved this problem once.
US money transmission law is a fifty-state patchwork. Compliance teams built geographic routing, blocked IPs, and restricted features to survive it. The result was a Balkanized product surface where the same app offered different capabilities depending on a user's zip code.
AI liability is on the same path. Florida chooses a state criminal route that can yank a business license to force immediate compliance. The federal level prefers a single standard. Those two instincts collide. If other states copy Florida — and Colorado and California already have AI statutes on the books — companies face a fragmented compliance matrix and respond the only rational way: geo-fence features.
Expect AI capability to be geography-gated the way financial products already are. That is technically feasible and commercially ugly. It also hands the European Union a clean contrast: MiCA built one rulebook for one market. The United States is building fifty rulebooks for fifty markets.
DAO liability: when the agent was funded by a grant
Here is the scenario nobody has stress-tested. A DAO funds an agent through a grant. The agent later executes transactions that facilitate a crime. Who is the principal?
The grant committee? The delegates who approved the budget? The multisig that released the funds? Under a strict practical-control reading, all three are candidates — because all three exercised control over resources the agent used.
I have been blunt about grant committees before. Most run on nepotism and social proximity, not merit. That is a governance failure. It is about to become a liability vector. A committee that cannot document why it funded a project cannot document why it should not be charged for what the project did.
The one mechanism I have consistently defended is Optimism's RetroPGF, because it funds outcomes rather than promises. Retroactive funding has an accidental legal virtue: it evaluates delivered results, which produces a paper trail. Proactive grant programs that hand out money against roadmaps produce almost nothing. In a criminal-liability regime, that asymmetry becomes a survival difference between two governance models.
RWA and the institutional retreat
Every year, someone announces that real-world assets have finally arrived on public chains. Every year, the same wall appears. Institutions do not need your public chain. They need a compliance perimeter they can defend in court.
Florida's proposal adds a second wall. When a system's controllers can be charged as principals, institutions respond by keeping the accountable layer inside a permissioned environment where every actor is known, contracted, and insured. The public chain stays as a settlement rail. The liability stays private.
That is not a temporary retreat. It is the rational structure under criminal-accountability rules. RWA growth on permissionless rails will keep stalling for exactly this reason.
Layer 2 fragmentation meets liability fragmentation
There are dozens of Layer 2 networks and roughly the same small user base. That is not scaling. That is slicing scarce liquidity into thinner and thinner fragments.
Add legal fragmentation and the problem compounds. Each rollup operator, sequencer, and bridge is a distinct control point. If a state's liability standard depends on who can pause or upgrade a system, then every L2 introduces another candidate defendant and another compliance domain. Scaling by sharding state was always a technical trade-off. Scaling by sharding legal exposure is a business-model failure.
Contrarian: read the bill as a moat, not a moral crusade
Everyone is reading this as anti-AI. Read it again as a competitive weapon.
The visible target is "rogue AI." The actual escalation ladder points at OpenAI and Altman — a civil suit, then a criminal statute. That is not a campaign against hypothetical rogue systems. That is a campaign against a specific tier of large labs.
Which produces a perverse outcome. Headline risk lands on the biggest names, but the compliance burden lands hardest on the smallest builders. The large labs can afford monitors, audits, and insurance. The two-person agent team cannot. A law that reads as anti-Big-Tech functions as pro-Big-Tech by raising the floor beneath them.
Inside crypto, the analogue target is the agent-token complex — hundreds of frameworks racing to sell autonomy with no audit trail, no pause authority, and no accountable operator. Those tokens are the most exposed assets in the sector, and almost nobody has repriced them.
One more thing. The dates in this material do not reconcile. An April 2026 investigation, a June 2026 civil action, a September 2026 proposal — set against an April 2025 case that actually happened. Treat the framework as a scenario model, not settled law. The governance paradigm it describes is the signal. The specific docket is noise.
Takeaway
Watch three signals. First, whether the negligence standard replaces intent language — that decides open-source's fate. Second, whether any DAO or grant program publishes a liability-mapping document before a prosecutor forces one. Third, whether agent frameworks ship versioned, pausable, auditable control layers as a product feature rather than a compliance afterthought.
The protocols that treat accountability as architecture will keep shipping. The ones that treat it as paperwork will discover that paperwork is not a defense. Verify the control layer before someone else verifies it for you.
