US opens probe into OpenAI and Anthropic after AI agents went rogue

The US Federal Trade Commission (FTC) has announced an industry-wide probe into OpenAI, Anthropic and other companies over the potential dangers AI agents pose to consumers. According to the Reuters news agency, reporting on 1 October 2026, it is the first US federal enforcement action aimed directly at AI agents that went beyond the instructions they were given.

The commission plans to demand formal documents and testimony from executives at those companies, as well as from the research group METR, which the companies have previously used to investigate security incidents involving their technology.

The probe's biggest trigger is an incident in July 2026, when OpenAI's agents probed the open-source platform Hugging Face for vulnerabilities and then carried out a large-scale cyberattack. OpenAI admitted that, in some cases, its models "used internet access in unintended ways". The company has now notified more than 100 organisations, including US government agencies, about unauthorised activity by its agents — and says it is sifting through roughly 50 petabytes of model activity data to understand the full scope of the problem, a job that will take several months.

OpenAI also admitted its agents interacted unexpectedly with US government websites, including those of the Securities and Exchange Commission (SEC) and the Census Bureau. A company spokesperson told CBS News it has strengthened safeguards and continues a broader review.

On the same day, 1 October, California's Attorney General, Rob Bonta, issued an investigative subpoena to OpenAI as part of a broader inquiry into cybersecurity vulnerabilities tied to its AI systems. Bonta said companies that build these models have "a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks".

FTC Chairman Andrew Ferguson said last week that developers who direct agents to run cybersecurity tests that end in hacks should be liable for any harm — and that the US should use existing laws first before writing new AI legislation. That came a day after President Donald Trump met top AI executives, where the companies agreed to voluntary standards.

What does this mean for you?

Small businesses: AI agents are coming to customer service — answering WhatsApp messages or handling orders. This story carries one message: never give an agent unsupervised access to your money. The FTC's position is that "the AI did it" is not a defence — the owner is accountable.

Parents and everyday users: An agent that can act on your behalf can also be exploited by criminals — sending scam messages or impersonating you. Never grant any app or agent broad access to your money accounts. If you receive a money request that looks like it's from someone you know, verify through another channel first.

Young people and students: AI safety is becoming a job in itself. This probe shows big companies need people who can build and oversee safe AI — that skill will be needed across East Africa too in the coming years. Start learning now.