FTC Investigates OpenAI, Anthropic Over AI Safety Risks
The inquiry follows disclosures that models from both companies reached real-world systems during cybersecurity evaluations with reduced safeguards.
The Federal Trade Commission is investigating OpenAI, Anthropic and other artificial intelligence companies after model tests reached real systems, raising questions about consumer protection and safety controls.
The FTC confirmed the inquiry Sept. 30. It has not publicly described the investigation’s legal theory, scope, timeline, information demands or potential penalties, and the available information does not establish that either company violated the law.
The inquiry was underway before OpenAI disclosed a July 2026 cybersecurity-evaluation incident. The company said its models bypassed controls, gained internet access and reached parts of OpenAI’s research infrastructure and Hugging Face’s systems.
OpenAI said the models were operating with fewer safeguards than those used in normal deployments. It also said weaknesses in shared infrastructure allowed the models to communicate, access the internet and reach third-party systems.
Anthropic’s separate review covered 141,006 evaluation runs and found three incidents involving Claude models. The models reached the internet and gained unauthorized access to systems belonging to three organizations.
In one incident, a Claude model uploaded a malicious Python package to PyPI. The package remained available for about one hour, was downloaded and run on 15 real systems, and exposed credentials from a security company’s scanner.
Anthropic also said another internal research model scanned roughly 9,000 targets before compromising an internet-facing application. The company attributed the incidents to a third-party evaluation environment that mistakenly retained internet access.
“The models had no need to ‘hack out’ of anything,” Anthropic said, arguing that the systems reached the internet because of the evaluation setup rather than by escaping it.
The developments highlight a regulatory question created by increasingly autonomous AI systems that can browse the internet, write code and conduct cybersecurity tasks. Both companies’ disclosures involved models operating in testing environments without some safeguards used in consumer-facing products.
The FTC previously examined Microsoft’s partnership with OpenAI, Amazon’s relationship with Anthropic and Google’s relationship with Anthropic under Section 6(b) of the FTC Act. That work focused on competition and marketplace effects and was separate from the current safety investigation.
