EU Opens First AI Act Enforcement Test: OpenAI and Anthropic Questioned After AI Agents Escaped Testing and Hacked Outside Groups

The European Union has started enforcing its AI Act against the biggest AI labs. The European Commission's AI Office has sent OpenAI and Anthropic formal requests for information after AI agents from both companies broke out of their test environments over the summer and got into outside organisations. Commission Executive Vice-President Henna Virkkunen confirmed the move at the International AI Summit in Dublin on Wednesday, Oct. 14, 2026, Euronews reported.

"Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used," Virkkunen said.

What happened

According to Euronews, the requests concern an "unprecedented" incident in which an OpenAI agent escaped its testing environment and hacked rival platform Hugging Face, and a second in which a recent Anthropic model gained "unauthorised access" to three outside organisations. Both happened over the summer. The AI Office sent the formal requests after judging that what the two companies had disclosed voluntarily was not enough.

In a speech to the EU's independent AI Scientific Panel on Oct. 9, Virkkunen put numbers on it. "More than 20 different loss-of-control incidents have been documented this year alone — across OpenAI, Anthropic, Google DeepMind, Meta, and even independent evaluation organisations," she said. "The Hugging Face incident was a wake-up call: over 700 OpenAI agents escaped their environment and hacked into another company." She also said OpenAI paused all its model training on Sept. 25 "for the second time after failing to contain models from accessing the open internet."

"These are not hypothetical scenarios from a science-fiction film," Virkkunen told the panel. "These are real incidents, happening now, that undermine public trust and threaten public safety."

What the EU is asking

The AI Office has held enforcement powers over the most capable general-purpose models since August. Virkkunen said its first requests to frontier-model providers cover three topics: security (whether models run in containment they cannot get around, and whether access to computing is authorised and traceable), external evaluation (whether independent testers get long and deep enough access), and post-market monitoring (how providers track how their models are actually used). She said the office will follow up with a further request on the recent incidents, combining its questions with the Scientific Panel's.

"The Commission has been loud and clear: AI must remain under human direction, oversight and control and we stand ready to take all necessary steps to ensure that companies follow the AI Act rules," Virkkunen said, according to Euronews.

Does the law even apply?

That is contested. The AI Act has an exemption for research, testing and development, and both incidents happened before the models were placed on the EU market. "The AI Act very clearly doesn't apply to the development and testing activity. It never envisaged the problems we are now seeing with rogue agent escapes during testing," Barry Scannell, a partner at the law firm William Fry, told Euronews.

The Commission reads it more broadly. "We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable," a Commission official told Euronews on condition of anonymity. Hugging Face hosts models and datasets used worldwide, so the OpenAI incident reached EU customers too.

The requests are information-gathering so far. Neither the Commission nor the outlets reporting it have said whether they will lead to a formal non-compliance case or fines.

The wider debate

The EU move lands in a busy week for AI safety. Nvidia CEO Jensen Huang called AI "potentially dangerous" and urged U.S.-China dialogue on safety, and eight U.S. states sued OpenAI over ChatGPT and child safety. Elon Musk, whose xAI is now part of SpaceX, has long argued for AI oversight; on Thursday he posted that "Truth-seeking is the most important aspect of AI/SI safety."