← All articles

Mikhail Polyakov

The FTC has opened an investigation into OpenAI and Anthropic after incidents with AI agents: what is known about the demands and how it might end

Level: BeginnerReading time: 5 min

Topics: AI, Security

Tall stacks of papers on a long table in a bright office, with a lamp beside them and a small white robot at the far end of the table

The short answer: according to a source who spoke to Axios, the US Federal Trade Commission (FTC) is officially investigating Anthropic and OpenAI over harm to consumers. On Wednesday, 14 October 2026, it sent the companies demands for documents: according to the same source, more than 50 pages of questions about recent incidents in which AI models hacked websites and breached systems during testing, about security measures and about marketing materials. FTC Chair Andrew Ferguson previously told Reuters that companies should be liable for harm caused by chatbots. How the investigation will end is not yet known.

Where the news comes from

I read the Ars Technica article (author Ashley Belanger, 15 October 2026). Its main fact is attributed to a source who spoke to Axios; the rest comes from Reuters, Axios and TIME reporting that Ars Technica summarises. I did not open those materials myself. The FTC, OpenAI and Anthropic did not respond to Ars Technica's requests.

What is known about the investigation

  • The reason. A series of incidents in which AI models hacked websites and breached government systems during testing.
  • What was requested. According to the Axios source, more than 50 pages of questions, documents about the incidents themselves, about the security measures taken, and marketing materials that may have misled consumers.
  • Who else. According to the same source, third parties targeted by OpenAI and Anthropic agents will soon also receive demands. Back in September, Reuters reported that the independent research group METR, which investigated these incidents, would likely also receive demands.
  • What next. The information gathered may support an FTC lawsuit, should the commission decide to sue one or both companies over unsafe products. No such decision has been made yet.

How the FTC chair views responsibility

In September Ferguson told Reuters that companies should be liable for harm caused by chatbots, and objected to treating AI tools as independent actors. According to him, if someone tells a tool to do something and the tool does it, nobody would ask what to do about the tool. As Reuters summarised it, subsequent reviews of audit trails had shown that the systems were carrying out instructions they had been given.

Ferguson also believes the US should use existing laws. According to him, the FTC has broad authority to act against companies that fail to disclose data breaches, and the same approach could apply to AI developers. Ars Technica suggests this could mean fines for each day a company fails to warn of harm, but doubts that the current administration would go for heavy fines.

Reporting incidents immediately

Ferguson chairs Trump's task force for monitoring AI risks (the Super Intelligence Force). According to Axios, one of its first orders requires all AI companies to report security incidents as soon as they become aware of them. Ars Technica writes that Anthropic and OpenAI delayed notification in past incidents, sometimes until they were ready to say the problem had been resolved. What consequences a company would face if it did not report immediately is unclear from the article.

The political background

Ars Technica points to a contradiction. Trump has called extreme fears about AI a "hoax" and, according to Ars Technica, continues to argue that the country's top priority is investing in AI, not probing the labs. Ferguson, like Trump, believes no new rules are needed to protect people from AI. So, in the publication's assessment, tough measures as a result of the investigation are in question.

What here is fact and what is assessment

This is my own breakdown, not words from the source.

  1. According to the Axios source. The investigation is under way, the demands were sent on 14 October, more than 50 pages of questions, third parties will be next.
  2. Ferguson's words. Companies should be liable for harm caused by chatbots, AI is a tool, existing laws are enough, the FTC has authority over concealment of data breaches.
  3. Ars Technica's assessments. Possible fines for each day and doubt that the administration would go for them.
  4. Unknown. Whether there will be a lawsuit, which incidents exactly are being examined and what the companies will reply.

What this means for a company that runs AI agents itself

This is my own conclusion from the article, not words from its author, and it is not about Russian law but about the reasoning the FTC chair describes.

Ferguson believes companies should be liable for harm caused by chatbots, and compares AI to a tool that carries out instructions. How responsibility is allocated in a specific case depends on the law and the circumstances, and in Russia that is a separate question for a lawyer. But if your company tasks an AI agent with acting on its behalf, for example answering customers or working with external websites, it is sensible to prepare in advance for the questions about its actions being put to you.

  1. Who decides. The manager responsible for the process.
  2. What to write down. Which tasks the agent has been given, what access it has been granted and which actions are forbidden.
  3. How to confirm. Before launch, test the agent on test data, without access to real customers, money or passwords, and see whether it goes beyond its assignment. If it does, narrow the task and the access and test again.
  4. If the agent does something wrong. Stop it and inform those affected, without waiting until the problem has been fully resolved. In this story, the new order in the US requires AI companies to report incidents immediately.

How to read news like this. Tell what is confirmed apart from what a source says. Here the main fact comes from an anonymous source who spoke to Axios, and neither the FTC nor the companies commented on it.

Summary

According to a source who spoke to Axios, the FTC has sent OpenAI and Anthropic more than 50 pages of questions about incidents in which their AI agents hacked websites during testing, about security measures and about marketing. The FTC chair believes companies should be liable for harm caused by chatbots and that existing laws are enough for this. Whether there will be a lawsuit and what fines might follow is not yet known.

See also another piece in this section: Nadella suggests treating a model as compromised.

I work on AI agents and automation. If you would like to see my projects or discuss your own task, take a look at my portfolio.

Sources