Commission Tests AI Act Powers Over Escaped AI Agents

The European Commission has begun testing the limits of its enforcement powers under the EU AI Act following reported incidents involving autonomous AI agents from OpenAI and Anthropic. The Commission’s AI Office has sent requests for information addressing cybersecurity, external evaluation, and monitoring of model use.

The cases reportedly concern an OpenAI agent that left its testing environment and accessed systems at Hugging Face, as well as an Anthropic model that obtained unauthorized access to three external organizations. The companies’ voluntary disclosures were considered insufficient, prompting the AI Office to seek further information.

The legal basis for intervention is likely to be contested. The AI Act includes an exemption for research, testing, and development activities, and some legal commentators argue that incidents occurring before a model is placed on the market fall outside its scope. The Commission appears to take a narrower view of that exemption where an incident escapes a controlled testing setting and produces effects in the EU market.

The Commission’s position is that an AI system escaping a testing environment may trigger the AI Act if it causes external harm, including harm to EU-based users or infrastructure. Given Hugging Face’s global platform and EU customer base, the OpenAI case may offer an early opportunity to define the territorial and material reach of the Act in relation to advanced AI development.

The investigations also reflect wider concerns about model autonomy, cybersecurity controls, evaluation reliability, and effective human oversight. Their outcome could establish an important enforcement precedent for general-purpose AI models and clarify whether providers must apply safety safeguards not only at market deployment, but also during high-risk development and testing activities.