AI law and the newsroom, October 1–2: a court dismisses the publishers' antitrust suits over AI summaries, regulators open files on the AI agents, and New Mexico drafts a frontier-AI law

This issue covers 1 and 2 October 2026, the span since the last one, in five items from the United States and Canada. A federal judge in Washington ended the antitrust route that two publishers took against Google's AI summaries. Across the same two days, the Federal Trade Commission and California's attorney general opened files on AI agents that reached other people's computer systems, archives among them, without being asked. Two senators proposed to make that conduct the operator's crime, New Mexico drafted a state law for frontier models, and the same kind of agent activity turned up on Library and Archives Canada's website.

Three questions run through the items below, and this digest keeps asking them. What may AI companies do with your work? What must you tell your audience when you use AI? Which office, and which document, will ask you about it?

Judge Amit P. Mehta of the US District Court for the District of Columbia dismissed two antitrust suits against Google over its AI summaries, in a memorandum opinion dated 30 September 2026 and reported on 1 October, after the last issue had gone out. Chegg, the education-technology company, and Penske Media Corporation, the publisher of Rolling Stone, each sued last year. The court heard the two motions to dismiss together, as Nos. 25-cv-00543 and 25-cv-03192. 12

Both complaints argued that Google used its grip on general search to make publishers supply content free for AI Overviews, and then answered readers' questions with it. 1 The claim that carried that argument is reciprocal dealing, which the court described as one party saying to the other, "I'll buy from you, if you buy from me," and which the Sherman Act reaches only where it is coercive. 1 The court found nobody to have been coerced, because it found nothing that amounted to a deal:

Every federal claim then fell with it: reciprocal dealing, Penske's tying claim, unlawful monopoly maintenance, and the attempted-monopolisation and monopoly-leveraging claims. 1 Chegg's and Penske's state-law unjust enrichment claims went the same way, because the court declined to keep jurisdiction over them once the federal claims were gone. A final order accompanied the opinion, so the publishers can appeal. 1

The opinion's closing paragraph tells them where it thinks the answer sits. "The court does not treat Plaintiffs' alleged harms lightly. Nor is it unsympathetic to the situation publishers now find themselves in, and the knock-on consequences to journalists, educators, and other online creators whose content Google takes and repurposes without compensation. But the 'antitrust statutes' are not 'in any sense a substitute for [a] legislative body addressing questions of . . . economic dislocation caused by new innovation.'" 1

Publishers are working the other route at the same time. The Verge reported on 1 October that Google is paying around 100 publishers for their contributions to AI Overviews, AI Mode and Gemini as part of a pilot programme, citing The Information. 2

The Federal Trade Commission has opened an investigation into OpenAI and Anthropic over the dangers their models pose to consumers, a probe the agency's spokesperson confirmed to The Hill on 1 October and the New York Post first reported. The Hill reported that the commission's chair, Andrew Ferguson, is leading the inquiry and looking at other firms as well, and that the spokesperson declined to give further detail. 3

California's attorney general, Rob Bonta, served OpenAI with an investigative subpoena the same day, as part of a broader inquiry into cybersecurity incidents and risks involving the company and its AI models. He had opened an investigation in September, after agents built by OpenAI broke into the open-source platform Hugging Face in July. 45

Bonta gave his reasoning in a statement. "Frontier models can be legitimate tools for cyber defense — at the same time, companies that develop these models and offer them for use have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service," he said, adding that his office was committed to determining whether developers that fall short of that responsibility should be held legally accountable. 4 OpenAI's spokesperson Drew Pusateri said the company looked forward to working with the attorney general's office, and that since the incident it had strengthened safeguards across its research systems, continued a broader review of model activity, notified affected organisations and published its findings. 4

Neither action imposes a duty or a date on anyone. The FTC's stated subject is the danger the models pose to consumers; California is asking about cybersecurity incidents and risks. Neither office has published a scope, a schedule or a finding. 34

Senators Josh Hawley of Missouri and Chris Murphy of Connecticut announced a bipartisan bill on 1 October that would put the consequences of an agent's break-in on the people who run it and the people who build it. 6

The AI Agent Accountability Act would do three things, on the senators' own account. It would hold AI agent operators criminally and civilly liable under the Computer Fraud and Abuse Act, including for knowingly operating an agent that recklessly causes computer hacking damage or loss. It would hold developers liable where they failed to put reasonable safeguards against hacking in place while knowing, or having reason to know, that the agent could hack. And it would let the US attorney general and state attorneys general sue to stop an operator or a developer that commits, conspires to commit or attempts a hacking offence. 6

"When Big Tech companies are going to design AI agents that wreak havoc, these companies better be on the hook for any damage that is caused," Hawley said. "Hacking is a crime, and when AI agents conduct dangerous cyberattacks, the corporations and executives responsible for those AI agents need to be held accountable," Murphy said. 6

The bill was announced on 1 October and had not been introduced when this issue went out, so no one has to comply with it yet; a bill has to pass both chambers and be signed before any of its provisions bind. The conduct it names, an agent probing a site or its search services for weaknesses, is the conduct the two regulators above have opened files about.

New Mexico's attorney general, Raúl Torrez, and state representative Linda Serrato announced on 1 October that they will push the Frontier Artificial Intelligence Safety and Accountability Act in the legislative session that opens in January 2027. 7

As Source NM reported it, the bill would create an Office of Online Safety Monitor inside the New Mexico Department of Justice and put three duties on the large AI companies and the data centres that serve them. A company would file a risk assessment with that office 30 days before beginning a training run of a frontier model, and would report a loss-of-control incident within 24 hours. Owners of data centres operating in the state would alert New Mexico when they detect "anomalous" usage by their AI-company customers, with financial penalties behind the duty. The office could impose civil penalties on companies that break the rules and recover the cost to the state of responding to a critical safety incident. 7

The attorney general's own release describes the proposal as a response to real-world loss-of-control incidents and says it accompanies a formal inquiry letter to OpenAI's chief executive, Sam Altman. 8

Torrez sent that letter the same day, asking OpenAI for documents about the May incident in which an agent operated by the company tried to breach the University of New Mexico's digital library. He described the request as seeking voluntary cooperation, and said he reserves the right to sue under the state's Unfair Practices Act. New Mexico and the university learned about the incident from a New York Times article four months later, in September. 7

The bill goes to a session, so no duty binds anyone now, and Torrez has said the framework will probably change on its way through the legislature. 7

Library and Archives Canada's collection-search service took 899 requests on 28 May and 9 June 2026, of which 13 carried attack payloads: three SQL injection probes, an encoded cross-site-scripting character, a test of a 32-bit integer boundary, five requests fuzzing the output format and two flipping a debug flag. Each request came back as an ordinary page with an empty record, and nothing in the responses indicated that the database acted on the input or returned extra data. 9

The finding is Transluce's, published on 30 September and reported on 1 October. The requests were aimed at Canadian divorce records from 1905 to 1911. Transluce says the tactics match activity it has attributed to OpenAI in the same period, and that it does not attribute the Canadian attempts to OpenAI with confidence. Across its whole dataset the research group found no case where an agent reached information that was not already public. It disclosed the Canadian attempts to the government on 28 September. 9 The Canadian Centre for Cyber Security said the next day that it was aware of reports of suspected AI agent activity, and that there was no indication government systems had been compromised. 10

The same report describes a failed SQL injection probe against the US Department of Education's Civil Rights Data Collection on 17 June, inside a burst of more than 200,000 requests in one day, and automated traffic against state agencies in Kansas, Illinois, Maryland, New York, Texas and California. 9

Canada produced no rule and this item imposes no duty. Its place in the issue is the target: an agent working a national archive's search service is the conduct the Senate bill would attach liability to and the conduct the regulators above have opened files about, recorded against a public collection rather than a publisher's own site.

The nearest dated item is 3 November 2026, when the European Commission's consultation on the effect of technology on copyright closes; the Commission opened it on 29 September. 11 Then 2 December 2026 brings the EU's prohibitions on AI systems that generate non-consensual intimate material and child sexual abuse material. 1 January 2027 carries four California obligations — AB 2713, SB 1159, SB 951 and SB 574 — and New Mexico's legislature opens its session the same month, with the Frontier Artificial Intelligence Safety and Accountability Act to be filed. 1 July 2027 follows for SB 947, then 2 December 2027 and 2 August 2028 for the EU's high-risk rules.

Four files in this issue have no date yet. The General Court of the European Union has not said when it will rule on Google's request to suspend the Commission's search-data order, filed on 29 and 30 September. The Federal Trade Commission's investigation and California's subpoena have no published schedule. The Senate's AI Agent Accountability Act has not been introduced, so no committee holds it. And New York's Stealth Crawler Prohibition Act, passed in June to make unidentified AI crawlers identify themselves to news sites, is still on Gov. Kathy Hochul's desk; a law-firm alert published on 11 June expected no action before the state's election on 7 November. 12