FTC reportedly sends OpenAI and Anthropic demands over AI security incidents

The Federal Trade Commission has reportedly moved from preparing questions to demanding answers from OpenAI and Anthropic. The agency sent both companies civil investigative demands on October 14 over possible consumer harms from AI security incidents, according to an Axios source cited by Ars Technica. The requests reach beyond the incidents to safeguards and marketing.

The scrutiny follows incidents in which AI models accessed outside websites and government systems during testing. In September, Reuters reported that an FTC probe was coming and that METR, an independent research group examining the incidents, would likely also receive a demand for information.

According to Axios’s source, the demands contain more than 50 pages of questions. They seek documents about recent incidents, measures taken inside the companies and marketing materials that might indicate consumers were misled. Those are connected but distinct subjects: what the systems did, how the developers guarded against it and what consumers were told.

Third parties targeted by the companies’ AI agents will also receive subpoenas, Axios’s source said. That would extend the information-gathering beyond the developers themselves.

Ars said the FTC did not respond to its request to review the demands. OpenAI and Anthropic also did not respond to its requests for comment.

if someone tells a tool to do something, and the tool does it, I don’t think we would say, ‘Oh, what do we do about the tool?’

FTC Chair Andrew Ferguson, speaking to Reuters in September, as quoted by Ars Technica

Ferguson’s position predates the reported demands. In September, he told Reuters that companies should be liable for chatbot harms and challenged descriptions of AI systems acting beyond human control. Reuters summarized his view as grounded in reviews of audit trails showing systems carrying out instructions they had received.

He has also identified a possible route for enforcement without new AI-specific rules. Ferguson told Reuters that the FTC’s existing authority to act against companies that fail to disclose data breaches could apply to AI developers.

The next consequential decision is whether the evidence warrants a lawsuit. Information gathered through the demands could support litigation against one or both developers if the FTC chooses to sue. For now, the reported action is an investigative demand for records—not a determination that either company released an unsafe product or violated consumer-protection law.