We didn't expect Westminster to discover rogue AI agents in the same legislative session it still can't define the term. Yet here we are. UK lawmakers are moving a "superintelligence bill" forward on the strength of three claims: that rogue AI agents pose a credible threat, that AI autonomy has advanced beyond safe thresholds, and that robust oversight must be treated as a matter of national security. Read the statements that have leaked out of the drafting rooms. The language is all alarm; the evidence is all anticipatory. Nothing in the public record specifies model architectures, training runs, benchmark results, or the threshold that separates a clever scaffold from a superintelligence.
That silence is the tell.
London is ignoring the signal growing in its own garden. A population of wallet-wielding autonomous agents has kept expanding through this bear market: entities rebalancing LP positions, harvesting yield, bidding in on-chain auctions, casting DAO votes. No human in the signing loop. No legal personality. No known jurisdiction. They are already moving real value, and not one of them is a superintelligence. The distance between the bill's fiction and the on-chain street isn't a rounding error. It's the story.
The superintelligence frame does political work long before it does technical work. A threat that hasn't arrived yet is a perfect substrate for legislation. You cannot falsify the urgency. No request for engineering details can slow the momentum. And every future incident will retroactively confirm the lawmakers who claimed they saw it coming. Rogue AI agents are this decade's Y2K bug, except Y2K had a date on the calendar while superintelligence has a date in a pitch deck.
I have watched this pattern before. Based on my audit experience in 2017, I spent a full day running the Golem pre-sale contracts through token-distribution edge cases, found three logic flaws that could have triggered mass inflation, and filed a GitHub issue that forced the protocol to pause. The fix happened fast. It happened fast because the code was public, the bug was reproducible, and the correction was verifiable by anyone running an Ethereum node. No committee hearing. No classified threat report. A ledger, an address, and a proof.
The current UK push has the regulatory aesthetics of that era without its mechanics. The bill is emerging from national-security review culture, where autonomy is treated as something to contain before it is understood. And yes, some agentic systems are dangerous in narrow ways. They can hold a conversation, chain tools together, and move money. We have already seen prompt injections, compromised keys, and unauthorized treasury drains. But look closely at what "dangerous" has meant so far: failures have clustered at the level of scaffold engineering. That is an urgent engineering problem, not an omnicidal revelation. Calling it a superintelligence is a category error.
Worse, the debate treats agents as if they occupy the same legal space as humans or corporations. A model cannot hold a passport. An agent cannot be served a summons. The class of software already executing financial decisions autonomously has no category in any jurisdiction that matters. A bill that criminalizes "rogue" autonomy without defining legal personhood for agents is drafting a law that cannot point at whatever it is meant to hit.
The on-chain agent population is the closest thing we have to a natural experiment on rogue autonomy, and the experiment was running years before Westminster discovered the word. MEV bots have conducted unsupervised value extraction since roughly 2020: sandwich attacks, liquidation sniping, time-bandit games. By the bill's loose standard, every arbitrage bot on Ethereum is a rogue agent. Each one executes strategy with zero human intervention, acts faster than any compliance officer could react, and respects protocol rules while ignoring regulatory intention. Across a full bear-to-bull rotation, these pseudo-agents extracted billions of dollars—and the financial system did not end. The market absorbed the pressure, developers hardened the protocols, and the extraction was priced into blockspace.
That, not a parliamentary subcommittee, is what robust oversight actually looks like: repeated attack, visible defense, and an open ledger to adjudicate outcomes. Code is law, but liquidity is truth.
Now add a generation of prompt-driven agents on top of that substrate, and the risk calculus changes in a specific, measurable way. The failure mode shifts from arithmetic greed to manipulation-by-language. The scariest agent exploits of this cycle did not require superhuman reasoning. They required prompt injection—a carefully crafted string of text convincing a model to sign a transaction its operator never intended. From my seat, that is a classic logic vulnerability rebuilt for LLM-shaped minds. The bug wasn't in a secret formula or an exotic training pipeline; it was in the collision between natural language and asset transfer.
This is the core mismatch. The bill wants to regulate the destination—superintelligence—rather than the junction where autonomy meets financial rails. National-security framing produces surveillance theater: reporting requirements, licensing schemes, personality questionnaires for algorithms with no fixed address. But the oversight we already know how to build is a mechanism, not a memorandum.
Here is the difference in tooling, reduced to pseudo-code:
# The regulatory model: oversight as designation
def classify_agent(agent):
if agent.reported_capability > "superhuman":
return "requires_licensing"
elif agent.operator_address == "unknown":
return "presumed_rogue"
else:
return "benign_enough"# The on-chain model: oversight as mechanism def constrain_agent(agent, policy): assert agent.can_sign(only_allowlisted_recipients=True) assert agent.has_rate_limit(max_tx_value=policy.limit) assert agent.transactions.are_public_until(policy.delay) return "monitored by machinery, not memoranda" ```
The first model depends on self-reporting, identity documents, and the assumption that any sufficiently advanced entity will file its paperwork on time. The second model treats oversight as code-level constraints, public auditability, and cryptographic enforceability. The bill's authors have reached for the first model to police systems that only the second model can actually restrain.
Then there is the centralization trap. Every time regulators propose licensing for autonomous systems, they create a compliance threshold calibrated to the largest incumbents. A frontier lab can hire an entire compliance department; an open-source developer experimenting with agent frameworks cannot. The predictable outcome is a market where autonomy is legal only if you are big enough to ask permission. And that is precisely the world where novel safety research goes to die. Licensing regimes become a mausoleum for innovation, built by people who genuinely believe they are constructing a hospital.
Watch the lobbying alignment closely. The labs that dominate frontier AI have every incentive to welcome a "superintelligence bill" that requires expensive safety filings. Regulatory capture is the quietest moat ever built. Meanwhile, the small teams building transparent, auditable agent infrastructure get priced out of legitimacy. The bill will not stop rogue agents; it will just make rogue agents the only affordable option for anyone outside the approved circle.
The second structural flaw is accountability laundering. If the text designates the agent as the rogue actor, it implicitly immunizes the humans who deployed it. A funding round, a model card, and an offshore wrapper later, the operator becomes indistinguishable from the victim. I spent three months dissecting the Terra/Luna collapse in 2022, and I saw the same architecture of denial in its governance. The mechanism required infinite growth; the governance assumed infinite foresight. Terra's code did not blow up because it was attacked by an external superintelligence. It blew up because its economic assumptions collided with a market that refused to believe the narrative.
The superintelligence bill risks building the same structure on the regulatory side. It assumes a committee can foresee every autonomous failure mode, and it guarantees that the first genuinely rogue incident will retroactively justify any overreach. That is not safety. That is narrative decay with a legislative mandate.
Liquidity pools don't testify at parliamentary hearings. They don't file comment letters. When the regulatory hammer swings, they just move. So ask what happens when the UK makes unlicensed autonomous agents illegal: the agents do not disappear. They relocate to neutral chains, to private mempools, to jurisdictions with clearer rules or no rules at all. The bill's national-security framing—the idea that containment protects the realm—actually pushes the most dangerous experiments into the least visible corners of the internet.
Track the on-chain data while the hearings drag on. The quantity of agent-originated transactions is still rising. So is the sophistication of attacker-controlled prompts. At some point—maybe within twelve months—an authenticated AI agent will cause a loss large enough to be called a national security incident. When it happens, the assembled regulators will say they told us so, and the bill will expand. The question is whether the new powers are designed to hide the systems or to expose them.
This is where I break with the panic on both sides. The people most threatened by the superintelligence bill's national-security framing are not the makers of imaginary rogue gods. They are the small, scrappy teams building transparent agent infrastructure—the exact teams the safety establishment should be subsidizing, not burying.
If "robust oversight" becomes a licensing regime, the incumbents win by default; they already have legal teams, compliance officers, and a seat at the consultation table. But if oversight means forcing every autonomous agent operating in the UK to run through auditable, publicly verifiable rails—on-chain identity, rate-limited keys, and spend limits—then the incumbents' proprietary opacity suddenly looks like the risk, not the solution. That is a truth the established labs do not want circulated.
Here is the contrarian thesis no one in Westminster will state: a truly rogue AI agent is far easier to stop on a public blockchain than inside a classified vault. In an open environment, the agent's constraints, recipients, and value limits are verified in public. The first anomalous transaction is visible before the second one settles. In a closed system with proprietary models and confidential training data, the malfunction is invisible until the damage is irrecoverable. Sunlight is the original alignment technique.
The bug wasn't a shortage of bureaucracy, and it never has been. The bug is the belief that a state can supervise a global, permissionless technology by declaring itself worried about it. Every crypto-native regulator who tried that playbook learned the same lesson: the code stays, the liquidity leaves, and the narrative gets rewritten somewhere else.
So watch the next three to six months for the drafting details. Does the bill mention verifiable constraints, public auditability, or agent transparency requirements? If it does, there is something worth building in the gaps. If it only creates a licensing regime and a surveillance apparatus, the signal is clear: the UK becomes another chokepoint, and the agent economy routes around it.
And when that happens, remember the deeper question this entire episode raises. We are about to hand autonomous systems control over trillions of dollars—or watch them seize it on their own. The debate about whether they will obey national borders is already obsolete. They will not. The real question is whether we force their controllers to make their methods visible, on an open ledger, before the first superintelligent incident makes the choice for us.
The politicians are arguing about ghosts. The buildable future belongs to whoever makes accountability infrastructure real. That is where the next cycle's alpha lives.