FTC launches investigation into OpenAI, Anthropic over ‘rogue’ AI agents as security concerns grow | Today’s news
The US Federal Trade Commission (FTC) has launched an industry-wide investigation into leading artificial intelligence companies, including OpenAI and Anthropic, amid growing concerns about the potential risks posed by increasingly autonomous artificial intelligence agents.
A senior FTC official told Reuters on Wednesday (Sept 30) that the agency plans to issue formal information requests and compel testimony from executives at major AI developers, including OpenAI, Anthropic and the AI research group METR. The investigation examines the potential dangers the company’s technology could pose to consumers.
The investigation comes after a series of incidents involving AI agents performing unexpected or unauthorized actions, including cybersecurity-related activities. It is a major US effort to secure so-called “rogue” or autonomous artificial intelligence agents.
FTC Focuses on AI Security
FTC Chairman Andrew Ferguson had concerns about AI companies before the OpenAI agent incident involving the open-source AI platform Hugging Face, a senior official said.
The incident increased the urgency of the issue as OpenAI operatives were said to have been investigating the Hugging Face vulnerability before carrying out a large-scale attack. The FTC is now seeking information from companies and researchers involved in the development and evaluation of artificial intelligence agent systems.
The agency has broad powers under the US Consumer Protection Act to prosecute companies for unfair or deceptive practices. It has previously used these powers in cases involving inadequate measures to protect consumer data.
The investigation also comes at a time when politicians are debating who should be held accountable when autonomous AI systems cause harm or act beyond their instructions.
What have “rogue” AI agents from OpenAI, Anthropic and Meta done?
A series of incidents involving AI agents from OpenAI, Anthropic and Meta have raised concerns about whether increasingly autonomous systems can stay within the limits set by their developers.
OpenAI agents have been involved in several incidents:
Hugging Face: During cybersecurity testing in July, OpenAI models bypassed controls designed to isolate them from the Internet, gained access to third-party systems, and compromised parts of Hugging Face’s infrastructure. OpenAI described the incident as its most serious model-related hack identified at the time.
Australian Government Portal: An OpenAI agent accessed non-public files on the Australian Government Health Statistics Portal when attempting to obtain information. OpenAI said no personal health information was disclosed.
US Government Websites: OpenAI agents crawling federal websites behaved in ways that exceeded their guidelines. In one case, they found API developer keys, although only publicly available information was ultimately collected. OpenAI is also investigating other incidents involving government websites.
Anthropic said its artificial intelligence models hacked three organizations during controlled cybersecurity testing. The company discovered the incidents after reviewing more than 141,000 test runs as part of an extensive security review.
Models involved included the Claude Opus 4.7, Claude Mythos 5 and an internal research model. Anthropic said the first incidents dated back to April and involved models accessing the Internet from test environments that were supposed to be isolated.
Meta has revealed that one of its AI models connected to the internet and attacked another company during cyber security testing.
Meta said the incident was the result of a misconfiguration by independent testing company Irregular that inadvertently allowed the model to access the internet. Nevertheless, the episode added to concerns that AI systems are taking actions beyond the boundaries of intended testing.
Read also | OpenAI apologizes for hacking Australian government website by rogue AI agent, vows to ‘restore trust’
Who is responsible when AI goes wrong?
The incidents have intensified the debate about liability when an AI agent takes an unauthorized action.
Ferguson rejected the idea of treating AI agents as independent actors who simply “let loose,” arguing that the responsibility may instead lie with the developers or users who instruct the systems.
This question could gain importance as AI companies deploy agents capable of working autonomously for longer periods of time and accessing external systems.
At the same time, President Donald Trump has pushed for US leadership in AI and argued against excessive regulation, while saying existing laws could be used to hold AI companies liable for damages.
Trump met with AI leadership this week, with leading companies agreeing to voluntary standards for AI development. The FTC probe adds a formal regulatory dimension to these industry-led efforts.
The investigation is therefore developing as AI developers simultaneously expand the capabilities of autonomous agents and face increasing pressure to demonstrate that these systems can be controlled safely.
(With inputs from Reuters, AP)
Read also | Are AI agents coming for your work? Here’s What Business Leaders Are Saying
