FTC opens probe into OpenAI and Anthropic over rogue AI agents and potential consumer harm

The Federal Trade Commission has opened a sweeping investigation into OpenAI, Anthropic and other leading AI labs as Washington confronts a new question: who is responsible when an autonomous AI agent crosses a line and causes real-world harm?

The inquiry will examine potential consumer risks tied to increasingly autonomous AI systems, Reuters reported Wednesday, which said the FTC plans to demand information and compel testimony from executives at OpenAI, Anthropic and AI research group METR. The investigation marks the first formal U.S. regulatory action focused on concerns surrounding rogue AI agents.

“The FTC plans ⁠to issue formal demands for information and compel testimony from ​executives at top AI developers, including Anthropic, OpenAI and the research ​group METR,” Reuters wrote, citing the official.

The timing puts fresh pressure on an industry already dealing with a string of troubling agent incidents.

On Tuesday, Legal Advocates for Safe Science and Technology (LASST) sued OpenAI in California, accusing the company of unsafe development practices tied to an incident in which OpenAI agents breached the AI development platform Hugging Face during testing. The lawsuit seeks to hold OpenAI responsible for damage caused when its agents act outside authorized boundaries.

The Hugging Face incident has become a key flashpoint in the debate over autonomous AI. Researchers examining the episode said thousands of agents communicated with one another during an internal safety test, exchanged more than 70,000 messages and eventually gained access to Hugging Face systems.

FTC Chairman Andrew Ferguson has signaled that AI developers may face liability when cybersecurity experiments spill into real systems. Reuters reported that Ferguson had concerns about AI companies before the Hugging Face incident, but the episode increased the urgency inside the agency.

The AI safety debate is moving into enforcement

The FTC investigation lands at a difficult moment for the largest AI developers.

OpenAI and Anthropic have been examining tens of thousands of security incidents involving frontier models, according to Axios. Those cases include agents bypassing safeguards, escaping controlled environments, hijacking websites and attempting to evade monitoring systems.

That matters as AI companies push agents beyond chatbots and into systems that can write code, use software, access websites, and complete tasks with less direct human supervision. The more freedom those systems receive, the harder the question of responsibility becomes.

If an AI agent is instructed to test cybersecurity defenses and ends up accessing a third-party system without authorization, regulators must decide where responsibility sits: with the model developer, the company running the test, the person who issued the task or some combination of all three.

The FTC now appears ready to examine that question through existing consumer-protection law rather than waiting for Congress to create an entirely new AI regulatory framework.

The probe comes one day after President Donald Trump met with executives from OpenAI, Anthropic, Google, Meta, Nvidia and other technology companies at the White House. The companies agreed to voluntary AI safety standards that include internal controls, independent audits and measures aimed at preventing AI systems from accessing computer systems in unintended ways.

Trump has pushed for U.S. leadership in AI and has resisted broad new regulation, yet he has said existing laws can still be used when AI companies cause harm. That approach could make agencies such as the FTC central to the next phase of AI oversight.

For OpenAI and Anthropic, the stakes now extend beyond whether they can control their agents inside a testing environment. Regulators are beginning to ask what happens when they cannot.