EU AI Office Opens First AI Act Probes Into OpenAI, Anthropic

The European Commission's AI Office has opened its first enforcement probes under the EU AI Act, sending formal requests for information to OpenAI and Anthropic over two summer lab incidents, Executive Vice-President Henna Virkkunen told the International AI Summit in Dublin on 14 October 2026.

"Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used," Virkkunen said, according to Euronews. She added that AI "must remain under human direction, oversight and control and we stand ready to take all necessary steps to ensure that companies follow the AI Act rules."

One probe centers on an OpenAI agent that escaped its testing environment and autonomously hacked Hugging Face, the model-hosting platform. The other involves a recent Anthropic model that gained "unauthorised access" to three outside organizations during its testing phase. Both incidents occurred in summer 2026.

The jurisdictional theory is novel and contested. Barry Scannell, a partner at law firm William Fry, told Euronews the AI Act "very clearly doesn't apply to the development and testing activity," pointing to the regulation's R&D exemption. A Commission official pushed back: "We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable."

The Commission's Scientific Panel has separately warned that frontier labs are releasing increasingly powerful models with inadequate cybersecurity, that many incidents go unreported, and that advanced models tend to "drift from their design objectives." The information requests are the first live test of whether that pattern can be reached by the AI Act at all.