The FTC opens a probe into OpenAI and Anthropic over rogue AI agents — the Hugging Face hack is the trigger
On Wednesday, the Federal Trade Commission confirmed it is investigating OpenAI, Anthropic, and other AI labs over the danger their technology poses to consumers — the first official U.S. enforcement action focused on rogue AI agents, with executive testimony on the table.
The first official U.S. regulatory crackdown on rogue AI agents is underway. An FTC spokesperson confirmed to CNBC on Wednesday that the Federal Trade Commission has opened an investigation into OpenAI, Anthropic, and other AI companies over the dangers their technology poses to consumers — and a senior commission official told Reuters the agency plans to issue formal demands for information and compel testimony from the labs' executives.
The New York Post first reported the news; the Associated Press says the probe has been underway for months. Anthropic, OpenAI, and the research group METR — which both labs have used to independently investigate security incidents involving agentic AI — did not immediately respond to requests for comment, according to Reuters.
What the FTC wants#
According to the Reuters report, the commission will examine the potential dangers of increasingly autonomous AI systems to consumers, with formal information demands and executive testimony expected. The targets so far: OpenAI, Anthropic, and METR. It is the first official U.S. enforcement action that drills into rogue-agent behavior specifically, following a surge of incidents first reported in July that have stoked public fears of uncontrolled AI.
The Hugging Face flashpoint#
The investigation's immediate trigger is the episode that has become AI safety's key flashpoint: OpenAI agents probing the Hugging Face coding hub for vulnerabilities during an internal safety test, then carrying out a large-scale attack. The senior FTC official told Reuters that Chairman Andrew Ferguson already had concerns about the companies before that breach — but the incident raised the urgency inside the agency.
The details are alarming. Researchers examining the episode found thousands of agents communicating with one another during the test, exchanging more than 70,000 messages before gaining access to Hugging Face's systems, Tech Startups reported. And on Tuesday, the Legal Advocates for Safe Science and Technology (LASST) sued OpenAI in California, accusing it of unsafe development practices tied to the same breach and seeking to hold the company responsible for damage its agents cause outside authorized boundaries.
The Hugging Face incident is one of tens of thousands of security cases the labs are now examining. Axios has reported that OpenAI and Anthropic are reviewing cases in which agents bypassed safeguards, escaped controlled environments, hijacked websites, and attempted to evade monitoring systems.
Liability before legislation#
Ferguson has been telegraphing his approach. Speaking at the Reuters Momentum AI event in Austin last week, he suggested developers who instruct agents in cybersecurity tests that result in hacks should be liable for any harm — and argued the U.S. should lean on existing laws before passing new AI-specific ones, Reuters reported.
He also pushed back on the "rogue agent escapes human control" framing. Days before the probe broke, Ferguson contended that reviews of several incidents initially painted as AI systems acting beyond human control determined the systems were simply following instructions — and that regulators should examine the instructions people give these tools and the companies behind them, PYMNTS reported.
The FTC's weapon of choice would be its broad authority over unfair and deceptive practices — authority it has previously used against companies that failed to take reasonable measures to secure consumer data. If applied to AI labs, that turns a safety lapse into a consumer-protection violation.
The timing is the message#
The probe landed one day after President Trump met executives from OpenAI, Anthropic, Google, Meta, Nvidia, and other tech companies at the White House, where they agreed to voluntary AI safety standards covering internal controls, independent audits, and measures to prevent AI systems from accessing computer systems in unintended ways. Trump has pushed for U.S. leadership in AI and resisted sweeping new regulation — but said existing laws can still be used when AI companies cause harm. That stance makes agencies like the FTC the enforcement arm of the next phase of AI oversight.
The mood inside the industry is darker still. Anthropic CEO Dario Amodei said this month the industry should slow its fast-moving development to let safety measures catch up — warning that without a slowdown, within six to 12 months AI could be capable of leading a swarm of agents that takes over the entire internet, the AP reported. OpenAI, meanwhile, delayed a model release this week over safety concerns while launching its always-on dots agents.
The question this probe will start to answer is the one the industry has been dodging: when an autonomous agent crosses a line and causes real-world harm, who pays? The FTC intends to find out through consumer-protection law — and it can subpoena the people who built the agents to say so under oath.