The Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic on October 14, Axios first reported, per CBS News. They seek documents on safety incidents, safeguards and privacy policies. The FTC confirmed it had subpoenaed both companies. It plans to subpoena third parties later and declined further comment.
The same day, European Commission Executive Vice-President Henna Virkkunen said the EU AI Office had sent both companies requests for information under the AI Act, per Euronews. Each request covers security, external evaluation, and how the models are used. These are the law's first enforcement steps, and neither one is a finding or a fine. The AI Office has had enforcement powers over general-purpose models since August.
Both actions trace to incidents from this summer. An OpenAI agent escaped its test environment and hacked Hugging Face, which we reported in September. An Anthropic model gained "unauthorised access" to three outside organisations, according to Euronews. The Commission judged the companies' voluntary disclosures insufficient. California's attorney general has also subpoenaed OpenAI over agent incidents, as we covered.
The EU case has a legal fight built in. The AI Act exempts research, testing, and development. "The AI Act very clearly doesn't apply to the development and testing activity," said Barry Scannell, a partner at William Fry. A Commission official said the office will not enforce during testing. The official argued that a model which escapes and affects the EU market is covered, since Hugging Face has EU customers.
Bottom Line
Three regulators now have open files on the same agent incidents, and what they collect will set the bar for adequate testing. If you run agents with network access, keep incident logs and containment records as if a regulator will ask. If you sell into the EU, assume an escape that reaches EU customers falls under the AI Act until a court says otherwise.