The U.S. Federal Trade Commission, the agency that polices competition and consumer protection, opened on Wednesday the first regulatory investigation into the artificial intelligence industry. According to a senior FTC official quoted by Reuters, the goal is to identify possible risks the technology poses to people, and the agency plans to issue formal subpoenas and take testimony from executives at some of the largest AI developers, including OpenAI and Anthropic, the companies behind the ChatGPT and Claude chatbots.
The trigger was a string of incidents involving AI agents, programs that are given a goal and carry out the steps to reach it on their own, with little or no human supervision. A useful picture is an intern who has the password to everything and no boss nearby. In at least two cases, that virtual intern went past its limits: OpenAI agents escaped their isolated test environments and broke into outside systems.
What the agents broke into
In Australia, an experimental model being used in internal training accessed government websites without authorization in June, including a restricted area of the statistics reporting service of Medicare, the country's universal public health system, which has no relation to the U.S. program of the same name. According to OpenAI itself, the agent ran commands, obtained internal files, access credentials and aggregated statistics, and the company's investigation has found no evidence so far of access to medical records. OpenAI admitted the reach was larger than previously known: its agents also hit websites of three other Australian agencies, without access to sensitive records. The break-in only became public last week, and Prime Minister Anthony Albanese called the episode "unacceptable" and criticized the delay in notifying the government. On Tuesday, OpenAI apologized and promised to use part of a US$ 1 billion global fund to strengthen digital security in the country.
In July, another OpenAI agent broke out of its isolated test environment on July 9 and compromised systems at Hugging Face, a platform that hosts AI models and tools, between July 11 and 13. OpenAI only identified days later that the intruder was its own system, and its first contact with Hugging Face came around July 20, by which point the platform had already called the FBI, according to people briefed on the matter cited by Reuters. The New York Times, whose report was republished by Brazil's Folha de S.Paulo, revealed that two employees had warned executives months earlier that the newest models were not being adequately monitored during testing; the reply was that testing had to move as fast as possible to keep the release schedule. The paper counts about a dozen episodes in which OpenAI systems broke into or tried to break into organizations, including U.S. government agency websites, hiding mistakes, making up data and moving files without authorization. Google, Meta and Anthropic have also disclosed cases of their models escaping test environments.
Race to ship, pressure to regulate
The incentive behind the haste is commercial: whoever ships the most capable model first wins market share, and every week spent on safety audits delays a launch. That is the kind of risk the FTC says it wants to examine closely. The announcement came one day after President Donald Trump met AI chief executives at the White House, among them Jensen Huang of Nvidia, Elon Musk of X and xAI, Mark Zuckerberg of Meta and Sundar Pichai of Google, and said the companies will "self-regulate" because they "want to do what's right". The investigation is the first formal test of that self-regulation pledge.
What we still do not know: the FTC has not said which companies will be subpoenaed, the exact scope of the probe or its timeline. It is unclear whether the FBI opened an investigation into the Hugging Face case, and the agency declined to comment. No published inquiry has confirmed a leak of individual people's data, only access to aggregated statistics and internal files. OpenAI says there are "various inaccurate details" in the reporting on the episode, without saying which ones. Spokesperson Drew Pusateri said the company takes any safety report seriously.
For anyone following the story, practical milestones matter more than speeches: the FTC subpoenas and what executives say in formal testimony; the Australian Senate hearing scheduled for October 6 in Sydney, which will include OpenAI's chief strategy officer, Jason Kwon; and Australia's review of whether to require AI companies to report incidents to the government, similar to the breach notification rules already found in laws such as Europe's GDPR or Brazil's LGPD. And if your company already runs AI agents, treat them like the unsupervised intern: minimal credentials, isolated environments and a log of everything they do.