The U.S. Federal Trade Commission (FTC) has opened a formal investigation into OpenAI and Anthropic over potential harm to consumers following a series of incidents involving artificial intelligence models during testing, including breaching websites and accessing government systems.
According to a source cited by Axios, the commission sent civil investigative demands to the two companies on Wednesday, containing more than 50 pages of questions and requests related to recent incidents, internal safety procedures, and marketing materials that could indicate consumer deception. The FTC did not respond to Ars Technica’s request to review the demands, and OpenAI and Anthropic did not respond to requests for comment.
What is the investigation examining?
The scope of the demands is not limited to what happened technically, but extends to how the companies handled the incidents and notified affected parties about them. The source said the commission also plans to subpoena third parties targeted by the companies’ agents. The FTC could use any troubling evidence it gathers to bring a case against either or both companies, alleging that they marketed unsafe products or violated consumer protection rules.
The move comes as OpenAI faces lawsuits alleging that its chatbot was linked to multiple harms, including the killing of a parent, children’s suicides, and school shootings, in addition to a lawsuit filed this week by eight U.S. states accusing ChatGPT of harming children, reinforcing delusions, encouraging dangerous behavior, and helping plan acts of violence.
Responsibility is not attributed to the agents’ “autonomy”
FTC Chair Andrew Ferguson rejects portraying artificial intelligence tools as acting independently of humans. He told Reuters that reviews of audit logs have so far shown that the systems were carrying out instructions they had received, despite AI companies sometimes describing their systems as exceeding human control.
This point carries legal significance because holding companies responsible could be based on the product’s behavior, how it was marketed, and disclosure procedures, rather than treating the agent as an independent entity responsible for its actions.
What is changing in practice?
The Trump administration’s “superintelligence” task force, which Ferguson helps lead, issued a directive requiring AI companies to report safety incidents as soon as they learn of them. The report indicates that OpenAI and Anthropic delayed reporting some incidents until they were ready to announce their resolution.
Ferguson believes the United States can use existing legal tools, including the FTC’s authority over companies that fail to disclose data breaches. According to his argument, this standard could apply to AI developers, opening the door to substantial fines for each violation and each day of delay in warning about emerging harm.
However, the investigation does not yet mean that the FTC has decided to impose fines or file a lawsuit. The potential size of the penalties and how data-breach disclosure rules would apply to incidents involving AI agents also remain unclear. These questions remain fundamental, particularly as the U.S. administration continues to prioritize investment in innovation while regulators seek to determine whether existing laws are sufficient to address the risks of systems that interact with websites and government systems.