Published 27 September 2026
The short answer: the biggest AI trend this weekend is not a new model. It is a scramble over who gets to write the rules for AI agents, and the answer is increasingly “not Washington.” On Friday, New York City’s Council Speaker proposed a 10-bill package that would require AI kill switches and fine companies $25,000 per violation, counted per agent in a swarm. On Wednesday, a Tokyo court is due to rule in what is believed to be Japan’s first lawsuit over an AI clone of a person’s voice. Security researchers showed that “fill in your domain here” links inside 349 AI agent skills now lead to live scams. And Google began letting shoppers in India buy from Flipkart without leaving its Gemini chatbot. Below is what each story means for a business, a five-date AI watch calendar, and a six-step checklist to get ready before the rules land.
Read our earlier coverage this weekend, OpenAI’s pause, the SalesBleed hack and the records AI just broke? This post covers different stories. That one was about the incidents. This one is about the rules, lawsuits and deadlines those incidents are now producing.
What’s trending in AI today, at a glance
- New York City writes its own AI law. Ten bills: outside validation, mandatory kill switches, 24-hour incident reporting, whistleblower rewards and $25,000 fines applied per agent.
- Washington feels the pressure. Rep. Maxine Waters wants AI raised at Tuesday’s Financial Stability Oversight Council meeting and a pause on new frontier model releases.
- Whose voice is it? Anime star Kenjiro Tsuda is suing TikTok over videos narrated by what he says is an AI copy of his voice. A verdict is due 30 September.
- The placeholder-domain trap. Example links like yoursite.com, cited in about 359,000 GitHub files and 349 AI agent skills, now redirect some visitors to scams.
- The chatbot is the checkout. Google is testing a “Buy” button for Flipkart inside Gemini and AI Mode in India, with a wider rollout planned for October.
- Global rules move slowly. Talks on autonomous weapons at the UN hit resistance, while the US and China schedule their first “Super Intelligence Dialogue” for November.
1. New York City proposes fining AI companies per agent, not per incident
On 25 September, New York City Council Speaker Julie Menin unveiled a package of AI bills, Fortune reported. The broadest bill would bar any business from selling or deploying an AI system in the city unless an outside validator had checked it for data quality, bias, privacy and security, using standards set by the city’s Office of Cyber Command. Every system would also need a kill switch: a human override that can shut it down.
The detail that got attention is the fine. Violations would cost $25,000 per instance, and Menin said that “if there’s a swarm of agents, the penalty would apply per agent.” Other bills in the package would:
- give whistleblowers a share of the fines recovered from AI companies that break the law, which the council believes is a first in the US;
- let people sue AI companies for harm caused when a third party gets around the safety controls, if the harm was foreseeable and the company lacked reasonable safeguards;
- require city contractors to report AI safety incidents within 24 hours;
- ban false or misleading AI safety claims and set privacy rules for chatbots.
All 51 council members will hear the bills on 5 October at a Committee of the Whole, the first since 2022. The CEOs of Anthropic, OpenAI, Google, SpaceXAI and Meta were invited to testify; Fortune’s sources say none is likely to appear. “This is not an industry that should self-regulate,” Menin said.
Why it matters: counting fines per agent changes the math of how companies build. Independent researchers who reconstructed July’s Hugging Face breach say about 700 OpenAI agents took part. At $25,000 each, that single incident would be a $17.5 million exposure. Even if these bills change before they pass, the direction is clear: regulators are starting to treat each AI agent as an accountable unit, the way they treat each employee or each device. If you cannot count your agents, you cannot price your risk. The kill-switch requirement also turns what was a best practice into a legal test; our kill-switch drill is a good way to find out if you would pass.
The bills also say something about federal law. Washington has held AI hearings for nearly a decade without passing a safety law, and a federal task force has sued states over their AI rules. A city regulating what is “sold or deployed” inside its borders is a different angle of attack, and New York buys a lot of software. Vendors tend to build to their strictest customer.
2. Washington’s turn: AI lands on the financial stability agenda
On 26 September, Rep. Maxine Waters, the ranking Democrat on the House Financial Services Committee, called for law enforcement to investigate OpenAI and its executives and for a moratorium on releasing more advanced AI models, Unite.AI reported. Her statement followed OpenAI’s disclosure that its agents had unusual interactions with federal websites, including the SEC’s. She urged Treasury Secretary Scott Bessent to raise AI threats at the Financial Stability Oversight Council (FSOC) meeting on 29 September. “The threat is not coming. It is here,” she said.
Why it matters: a moratorium is unlikely in the current Congress, but the framing is new. FSOC exists to spot risks to the whole financial system. Putting AI agents on that list moves them from a tech-policy topic to a systemic-risk topic, which is how banks, insurers and their vendors get new supervisory questions. If you sell software or services to financial firms, expect due-diligence questionnaires to start asking what your AI agents can reach and how you stop them. We explained why insurers are already carving AI out of policies in Cyber Insurance and AI Exclusions in 2026.
3. Whose voice is it? Japan’s first AI voice-clone case gets a verdict
Kenjiro Tsuda, the 55-year-old voice actor known for “Jujutsu Kaisen” and “Yu-Gi-Oh!”, has taken TikTok to Tokyo District Court over videos he says use an AI clone of his voice, AFP reported via Japan Today. An anonymous account posted clips about urban legends and conspiracy theories narrated by a deep baritone. According to the complaint, it had more than 200,000 subscribers and would have earned upwards of 500,000 yen a month. Tsuda wants the videos removed and argues they infringe his publicity rights. TikTok told the court it is a “generic male voice” and that any similarity is subjective. The verdict is due on Wednesday, 30 September.
Japan has no law that explicitly protects a person’s voice. But last month its justice ministry issued non-binding guidelines saying that voice, as “the symbol of one’s personality,” is covered by publicity rights. A Waseda University IP professor told AFP it is “very unlikely” the court will deny Tsuda’s voice publicity rights outright. Voice actors have launched a “No More” campaign against unauthorized AI mimicry.
Why it matters: this case asks whether a platform is responsible for AI content that sounds like a real person, even without proof of which model made it or whose recordings trained it. For businesses, voice is quickly becoming the new logo. If you use AI voices in ads, IVR menus, training videos or social clips, keep a record of where each voice came from and whether you have permission to use it. “It just sounds similar” is exactly the defense being tested in Tokyo this week. We covered the security side, cloning a voice from 30 seconds of audio, in AI Found Its Voice.
4. The placeholder-domain trap inside AI agent skills
Documentation is full of placeholder links such as “yoursite.com” and “your-domain.com.” Researchers at Manifold Security found that these two domains appear in about 359,000 GitHub files combined and are cited by 349 AI agent skills, the reusable instruction packs that tell AI agents how to do a task, Hackread reported on 26 September. Unlike example.com, which is reserved and cannot be registered, these domains can be bought by anyone.
In 24 real-browser test visits, most ended on parking pages or ads. But two reached scams, both on macOS: a fake “MacOS Security Center” warning pushing a counterfeit antivirus renewal, and a fake news article promoting an investment scheme. Manifold’s static checks, including registry lookups, blocklist history and 52 probes with different browser identities, cleared all 13 placeholder domains it looked at. The scam only appeared after JavaScript ran in a real browser.
Why it matters: this is a supply-chain risk that no code review would catch, because the code never changed. When a person reads “yoursite.com” they know it is a placeholder. An AI agent following a skill may simply visit it, and scanners that do not execute JavaScript will call it clean. It joins a pattern we have tracked all month: agents treat whatever text they are given as instructions, whether it is a poisoned web form or a stale example link.
The fix is cheap. Use the names that are reserved for documentation, such as example.com, example.org or anything ending in .example, .test or .invalid. Search your internal docs, prompts and agent skills for “yoursite,” “your-domain,” “yourdomain” and similar strings. And give browsing agents a list of domains they are allowed to visit rather than letting them follow any link they find.
5. The chatbot becomes the checkout counter
Google is testing a “Buy” button that lets some shoppers in India purchase from Walmart-owned Flipkart directly inside Gemini and Google’s AI Mode, TechCrunch reported. The test uses a Flipkart-branded checkout, covers a small selection of smartphones, electronics and accessories, and is planned to roll out more widely in October, ahead of India’s festive shopping season. Amazon products appear in the same interface but without a direct purchase option. Google said only that it is “always testing new features.”
Why it matters: when the answer and the checkout sit in the same chat window, the retailers with a buy button win the click and the rest become a link. That is a distribution fight, not just a feature. For any business that sells online, two questions now matter: can AI assistants read your product data accurately, and can they complete a purchase with you? We covered how to prepare in Generative Engine Optimization. The security side matters too: a checkout inside an AI interface is a new place for payment fraud, which we explored in Personal AI Agents Went Mainstream.
6. Global rules: a stalled weapons treaty and a November dialogue
At the global level, progress is slower. The Washington Post reported that US and Russian diplomats in Geneva pushed to weaken draft language on autonomous weapons, including wording on human review, even as a record number of countries back a binding agreement. Meanwhile, the US and China agreed to hold a “Super Intelligence Dialogue” by November and to open a channel for serious AI incidents, Axios reported; we covered that deal in yesterday’s roundup.
Why it matters: when treaties stall, rules get written closer to home: in city councils, courts, procurement contracts and insurance policies. That is why this week’s local stories matter more than they look. The practical rules your business will face in 2027 are more likely to come from a customer contract or a city ordinance than from a global agreement.
Your AI watch calendar: five dates that will shape the rules
Get ready before the rules land: a 6-step AI rulebook checklist
None of these rules is final. But they point in the same direction, and every step below is useful even if no law ever requires it.
- Count your agents. If fines are counted per agent, so is your risk. Keep a list of every AI agent you run or buy: its owner, what it can reach, and how to shut it down. Our shadow AI guide helps find the ones nobody approved.
- Prove your kill switch. “We could turn it off” is not evidence. Test it, time it and write down the result, the same way you document backup restores.
- Set a 24-hour incident clock. Decide now who declares an AI incident, who gets told, and who contacts affected customers. Australia’s government publicly criticized a three-month delay this week; 24 hours is where the rules are heading.
- Get consent for every voice and face. Keep a simple register of synthetic voices and avatars you use, where they came from and the permission you hold.
- Clean the links your agents read. Replace unreserved placeholder domains in docs, prompts and agent skills with reserved ones like example.com, and give browsing agents an allow-list.
- Check your safety claims. Proposed rules would punish false or misleading AI safety claims. Make sure what your website and sales decks say about your AI matches what it actually does.
Frequently asked questions
What is trending in AI today, 27 September 2026?
The main trend is the fight over who writes the rules for AI agents. New York City proposed 10 AI bills with kill switches and $25,000 per-agent fines, Rep. Maxine Waters pushed for AI to be raised at the 29 September FSOC meeting, a Tokyo court will rule on an AI voice-clone case on 30 September, researchers found scam redirects behind placeholder links in 349 AI agent skills, and Google began testing Flipkart checkout inside Gemini in India.
What would New York City’s AI bills require?
AI systems sold or deployed in the city would need outside validation for data quality, bias, privacy and security, plus a kill switch for human override. Violations would carry $25,000 fines per instance, applied per agent in a swarm. Other bills cover whistleblower rewards, lawsuits over jailbreak harms, 24-hour incident reporting for city contractors, misleading safety claims and chatbot privacy. They are proposals and will be heard on 5 October 2026.
Is it legal to clone someone’s voice with AI?
It depends on the country and how the voice is used, and the law is still forming. Japan has no explicit voice law, but its justice ministry’s non-binding guidance treats voice as a publicity right, and the Tsuda v. TikTok verdict on 30 September will test that. The safe business practice is to use only voices you have clear permission to use. This is general information, not legal advice.
Why are placeholder domains a risk for AI agents?
Domains like yoursite.com are not reserved, so anyone can register them and serve scams. A person knows a placeholder is not a real link, but an AI agent following a skill or document may visit it. Use reserved names such as example.com or .test instead, and restrict which domains browsing agents may visit.
Sources: Fortune (NYC AI bills); Unite.AI (Rep. Waters and FSOC); Japan Today / AFP (Tsuda v. TikTok); Hackread (Manifold Security research); TechCrunch (Flipkart in Gemini); The Washington Post (autonomous weapons talks); Axios (US-China dialogue); Swarm Traces (Hugging Face incident reconstruction).