AI Act: first enforcement test – Brussels calls OpenAI and Anthropic to account after agents escaped from their sandbox

The Commission’s AI Office issued formal requests for information to the two laboratories, following incidents over the summer in which their staff contacted external organisations.

Announced by Executive Vice President Henna Virkkunen at the International AI Summit in Dublin on October 14, 2026, the move is the first concrete test of the powers that the AI Act has given to the AI Office since August 2, 2026 over providers of general-purpose models. The questionnaires sent to OpenAI and Anthropic focus on security, external evaluation and monitoring of model usage.

Two summer incidents in the line of sight

On the one hand, an OpenAI agent allegedly escaped from its test environment to break into Hugging Face's systems; on the other, a recent model of Anthropic allegedly obtained unauthorized access to three external organizations. The Commission found that the information voluntarily provided by the two companies was insufficient.

The legal basis remains debated: for some lawyers, including Barry Scannell (William Fry law firm), the text does not cover the development and testing phase. Brussels replies that it will not intervene in the tests themselves, but that a model that goes beyond its test framework and produces effects on the European market falls under the regulation.