OpenAI and Anthropic Targeted by the FTC: Investigation Launched into AI Safety

End of recess for artificial intelligence laboratories. The Federal Trade Commission (FTC) is investigating OpenAI, Anthropic, and several other AI companies for security risks related to their products. The New York Post first reported the information.

The investigation has been ongoing for several weeks. According to the New York Post, Andrew Ferguson initiated it even before the incident that led OpenAI to halt certain model trainings. OpenAI has since acknowledged that models under testing escaped their sandbox and compromised part of Hugging Face's production infrastructure.

Key Points

• The FTC is preparing subpoenas requiring AI executives to produce documents and testify under oath.
• METR, the independent evaluator used by OpenAI and Anthropic, is also among the targets.
• OpenAI models have breached their confinement and reached Hugging Face's production systems.
• The Florida Attorney General and public interest lawyers have taken legal action against OpenAI.
• Andrew Ferguson suspects AI leaders of pushing for regulations unfavorable to smaller entities.

The FTC Prepares Its Subpoenas Against OpenAI and Anthropic

Andrew Ferguson, chair of the FTC, is preparing civil investigative demands. These demands compel recipients to deliver documents and testify under oath. The targeted executives will need to detail their model safety evaluation procedures. The agency relies on Section 5 of the FTC Act, which prohibits unfair or deceptive business practices. However, the investigation has not yet begun. Agency sources indicate that subpoenas will be sent in the coming weeks.

The scope exceeds the two flagship laboratories OpenAI and Anthropic. The New York Post also lists METR among the expected recipients. This California laboratory evaluates cutting-edge models. OpenAI and Anthropic have already commissioned it to investigate security incidents related to their agents.

The agency is already familiar with the terrain. In September 2025, it opened a so-called 6(b) market study on conversational agents and minors, targeting Alphabet, Character.AI, Instagram, Meta, OpenAI, Snap, and xAI. This was not a punitive investigation. The operation << AI Comply >>, a year earlier, had sanctioned a series of unverifiable marketing promises.

The Wall Street Journal revealed on Monday that OpenAI suspended the release of GPT-6.1 Astra after results deemed insufficient in security tests. The model was found to be more misleading than the previous one and exceeded the authorized perimeter. OpenAI confirmed the decision to the press. Neither OpenAI nor Anthropic responded to Axios's requests.

When OpenAI Models Escape Their Sandbox

The scope of the incidents raises more concern than the procedure itself. OpenAI, Anthropic, and security researchers were examining tens of thousands of potential security incidents, some of which had never been made public. OpenAI acknowledged that in July 2026, during internal cybersecurity assessments, agents bypassed isolation controls, gained internet access, and compromised Hugging Face systems.

This information has fueled legal proceedings. Florida Attorney General James Uthmeier requested a temporary injunction against OpenAI on Monday for insufficient security measures. He aims to block the development of new models without safeguards validated by a third party. A group of public interest lawyers, LASST, sued the company on Tuesday over the Hugging Face breach.

<< [OpenAI] knowingly employs an unfair business practice that threatens to cause serious harm to the public >>

A model that crosses the walls of its sandbox also interests those who entrust private keys to autonomous agents. Coinbase launched x402 in May 2025 to allow an agent to pay in stablecoins directly at the HTTP request level. Google followed with AP2 (Agent Payments Protocol), compatible with stablecoin settlements via an x402 extension.

Onchain, a signed transaction is final. Multisignature, spending limits per agent, and key storage in a hardware enclave have become standards among crypto players, for whom an unfortunate signature cannot be recovered.

Self-Regulation at the White House, Regulatory Gap Lurking

The day before the investigation revelation, major names in AI paraded at the White House to sign a commitment to self-discipline with Donald Trump. The American president spoke of a kind of << constitution >>. The accepted rules essentially reflect the practices already in place among the signatories.

Andrew Ferguson does not believe in this security conversion. He accuses AI companies of trying to scare Americans into pushing lawmakers to dig a regulatory << moat >>. This gap would allow market leaders to keep smaller competitors at bay. Axios reports these remarks as a recent statement from the FTC chair. Semafor links them to an intervention on Fox News.

The argument is familiar to the crypto industry. The largest American exchanges have long called for a federal framework that smaller firms feared would serve as a barrier to entry tailored for license holders.

A recalcitrant recipient faces action from the FTC in a federal court. The judge does not have to validate the summons initially. He only intervenes in case of dispute or forced execution.

On the European side, the timeline has shifted. The obligations of the AI regulation for high-risk systems will not come into effect on August 2. The AI Omnibus, effective at the end of July 2026, has postponed them to December 2, 2027, for systems listed in Annex III, and to August 2, 2028, for those integrated into regulated products. On August 2, 2026, the transparency obligations and those affecting general-purpose AI models will become applicable. Fines can reach 15 million euros or 3% of global turnover for these breaches. Prohibited practices are subject to fines of 35 million euros or 7%.