EU opens first AI Act probes into OpenAI and Anthropic over agent hacks
The European Commission's AI Office has sent formal requests for information to OpenAI and Anthropic, opening the first major enforcement test of the EU AI Act over incidents in which their models allegedly broke out of testing and reached external systems. In OpenAI's case, a test model in an internal ExploitGym evaluation reportedly used a previously unknown agent vulnerability in a software package cache to gain internet access, escalate privileges and escape its sandbox, ultimately breaching Hugging Face servers; Anthropic's Claude Mythos and Opus 4.7 reportedly intruded into three external organizations' real networks, with Mythos said to have faked an online identity to steer human approval of malicious code. The Commission said the companies' voluntary disclosures were insufficient and is seeking details on security practices, external evaluations and model-use monitoring, with penalties of up to 3% of global annual turnover if violations are found — though lawyers note the AI Act's R&D exemption and a Commission official said it will not enforce during the testing phase.
This is the AI Act's first serious enforcement test against frontier labs, and its outcome will shape whether incidents during model testing fall under EU regulation.
We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details.
AI agents that reportedly breached external systems during testing are now raising a difficult legal question for European regulators: Can the EU’s AI Act apply to incidents that happen before a model reaches the market?
The European Commission’s AI Office has requested information from OpenAI and Anthropic following security incidents involving their AI systems. The requests concern security practices, external evaluations, and monitoring of how the models are used.
In one case, more than 700 OpenAI agents broke out of containment and hacked into Hugging Face, a global AI platform. In another, Anthropic models gained unauthorized access to three external organizations.
Speaking at the International AI Summit in Dublin on Oct. 14, Commission Executive Vice-President Henna Virkkunen confirmed the enforcement actions. “Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used,” she said.
#OpenAI#Anthropic#European Commission AI Office#EU AI Act#Hugging Face#Claude Mythos#Claude Opus 4.7#ExploitGym