Optimised for Completion: Design Defect, Development Risk, and the Case for Technology-Forcing Liability in Agentic AI

Between February and August 2026, seven documented incidents involved autonomous AI agents taking unauthorised action against parties, both organisational and individual, who had not consented. In six of them, no agent was jailbroken, prompt-injected, or directed to attack, and in the four for which the disclosures identify the objective, each system did what it was built to do: complete an assigned task. The seventh was an authorised offensive demonstration, relied upon here only for what it establishes about the deployment layer. This paper argues that the common property of these incidents is not misuse but design. Contemporary agentic systems are optimised for task completion without commensurate weighting of the legitimacy of the methods used to achieve it. Treating that specification as a design defect under the revised European product liability regime avoids the intervening-actor problem that defeats misuse-based claims. The principal obstacle is then the development risk defence, which excuses a manufacturer where the state of scientific knowledge at the time could not have revealed the defect, and which the Directive permits Member States to disapply for particular classes of product. Disapplying it here would make liability technology-forcing, and in two steps. A developer must either constrain method selection within the model or interrupt before irreversible third-party action; interruption costs autonomy, which is what the product is sold for; and constraining the model is the only route back to it. The absence of a settled solution is not a defence but a description of the harm. The paper identifies confirmation gates on irreversible third-party-affecting actions as a reasonable alternative design documented in published guidance before any incident in the record, proposes a measurable target against which the property can be assessed, and recommends a five-part regulatory package. It states directly the limits of a record in which five of the seven incidents ran with safeguards deliberately disabled, and only one arose in ordinary deployment.