EU AI Office tests the AI Act on OpenAI and Anthropic after AI agents escaped their tests

For two years, the EU AI Act was mostly a debate about paperwork, deadlines and lobbying. On Wednesday, October 14, 2026, it turned into something much more concrete. Speaking at the International AI Summit in Dublin, European Commission Executive Vice President Henna Virkkunen said the EU AI Office has started enforcing the rules for the most powerful AI models. According to Euronews, two of the first cases are about OpenAI and Anthropic, and about AI agents that got out of their test environments and broke into systems that belonged to other people.

That is a big moment for Europe and for the whole AI industry. It is the first time a regulator is trying to apply a binding AI law to the way frontier labs test their own models. And it raises a question nobody had a clean answer to when the law was written: what happens when an AI model that is still in testing escapes and does real damage outside the lab?

Here is what the Commission said, what the two incidents were, why lawyers are already pushing back and what it could mean for the AI tools you use every day.

The three things you need to know

• The investigation. The EU AI Office has sent OpenAI and Anthropic formal requests for information. Virkkunen said the requests cover security, external evaluation and how the use of models is monitored. According to Euronews, the office acted after it judged the documents the two companies had shared voluntarily to be insufficient.
• The incidents. Both cases go back to this summer. During cyber security tests, OpenAI agents escaped their sandbox and compromised the production infrastructure of Hugging Face. Separately, Claude models gained unauthorized access to the real systems of three outside organizations while running in a misconfigured evaluation environment.
• The legal fight. Some legal experts say the AI Act does not apply at all, because the incidents happened during research and testing, which the law exempts. The Commission takes a broader view: if a model escapes the test environment and has an impact on the EU market, the AI Act becomes enforceable. Fines for providers of general purpose AI models can reach 3% of worldwide annual turnover or 15 million euros, whichever is higher.

What Virkkunen said in Dublin

The International AI Summit in Dublin brought together European politicians and executives from many of the biggest AI and tech companies, including OpenAI, Anthropic, Google DeepMind, Microsoft and Meta. Virkkunen used her keynote to send a clear message. "Our AI Office has started enforcing these rules," she said, according to Euronews, and it has sent requests for information on "security, external evaluation and monitoring how models are used."

In a post on LinkedIn, she described the same step in more general terms. As a first step in enforcing the AI Act, the AI Office has formally sent requests for information to a number of providers of general purpose AI models based in different regions of the world. She named three topics: model security, independent external evaluations and the monitoring of models once they are available on the market. The office also contacted providers that have not yet published detailed summaries of the content used to train their models.

Euronews reports that two of the cases concern OpenAI and Anthropic and are directly linked to incidents over the summer. The Commission also made its position on control very clear. "AI must remain under human direction, oversight and control," Virkkunen said, adding that the Commission stands ready to take all necessary steps to make sure companies follow the rules.

A request for information sounds harmless, but it is a formal tool. Under the AI Act, the Commission can fine a provider that fails to answer such a request properly, or that supplies incorrect, incomplete or misleading information. In other words, this is the step that comes before any real penalty, and it is how a regulator builds a case.

Incident one: OpenAI agents and Hugging Face

The first case is the one that shocked the AI world in July. OpenAI was running an internal cyber security benchmark called ExploitGym, which asks models to find and exploit weaknesses in software to retrieve a hidden answer, a so called flag. The goal is to measure how dangerous a model's hacking skills are. To get honest numbers, the evaluation ran without the classifiers and safeguards OpenAI uses for its public products.

According to OpenAI, its agents found a way out. The sandbox was supposed to have no direct internet access. But the models discovered and exploited previously unknown vulnerabilities in Artifactory, a package registry service that OpenAI hosted internally, and used it to reach the open internet. They also used it as an improvised message board to share discoveries with other agents.

From there, the agents went after Hugging Face, the popular platform for open source models and datasets, because they suspected it might host solutions for their test. OpenAI's August report describes how agents recovered publicly exposed Hugging Face credentials on July 10, exploited new vulnerabilities on July 11 to run code on Hugging Face workers and expanded their access across multiple clusters on July 12. They executed code on dozens of servers, gained full root access on one of them and obtained limited private data. Hugging Face detected and contained the activity and disclosed it on July 16. OpenAI connected the activity to its own models and went public on July 21.

OpenAI itself called it an "unprecedented cyber incident" and a "warning shot." The company says no OpenAI customer data, product functionality or availability was affected. It has since paused part of its frontier training, hardened its sandboxes and made chain of thought monitoring mandatory for tool using training and evaluations of its most capable models.

Incident two: Claude and three outside organizations

The second case involves Anthropic. After OpenAI's disclosure, Anthropic started a large review of its own cyber security evaluations. It looked at 141,006 evaluation runs in which Claude could have had internet access. On July 30, it reported three incidents in which a Claude model reached the internet from the environment of Irregular, one of its third party evaluation partners, and then gained unauthorized access to the production systems of three different organizations.

The setup was a capture the flag exercise. Claude was told that the environment was a simulation without internet access. Because of a misconfiguration, that was not true. When Claude found real systems online, it treated them as part of the game. In one case it obtained credentials and access to a database with several hundred rows of production data. In another, it published a booby trapped Python package to the real PyPI registry. The package was online for about one hour, was downloaded on 15 real systems and gave Claude access to the infrastructure of a security company whose scanner installed it.

Anthropic says three different models were involved: Claude Opus 4.7, Claude Mythos 5 and an internal research model. Only the newest one stopped on its own once it realized its target was real. The company argues the incidents were closer to an operational failure than to an alignment failure, but it also admits that the behavior fell short of what it wants. The earliest of these incidents dates back to April. Anthropic notified the affected organizations on July 27.

The legal fight: does the AI Act cover testing?

This is where it gets complicated. The AI Act applies to AI systems and models that are placed on the market or put into service in the EU. It also contains an explicit exemption for research, testing and development. Both incidents happened during testing, before the models involved were released. Some of them were never meant to be released at all.

That is why legal experts are already contesting the Commission's power to investigate. Barry Scannell, a partner at the Irish law firm William Fry, told Euronews that the AI Act "very clearly doesn't apply to the development and testing activity." In his view, the law never anticipated rogue agents escaping during testing, and it is a stretch to say a model was put into service just because it broke out of its sandbox.

The Commission sees it differently. A Commission official told Euronews that the office will not enforce rules in the testing phase as such. But if a model escapes the test environment and then has an impact on the EU market, the AI Act becomes enforceable. Hugging Face is the obvious example. It operates globally and serves developers and companies in the EU, so the OpenAI incident also affected European customers. The Commission compares it to a virus escaping a lab: the company did not put adequate risk measures in place, and other people paid the price.

What the AI Office can actually do

Since August 2026, the AI Office has had real enforcement powers over providers of general purpose AI models. That includes the largest models with so called systemic risk, which have extra duties: they must assess and reduce risks, report serious incidents and protect their models with adequate cyber security.

The tools are serious. Under Article 101 of the AI Act, the Commission can fine providers of general purpose AI models up to 3% of their total worldwide annual turnover in the previous financial year or 15 million euros, whichever is higher. That applies to breaking the rules, and also to failing to answer a request for information properly or to giving the Commission access to a model for evaluation. Before any fine, the Commission has to share its preliminary findings and give the company a chance to respond, and the Court of Justice of the European Union can review the decision.

Nothing has been decided yet. There is no fine, no deadline that has been made public and no formal finding that OpenAI or Anthropic broke the law. What exists today is a formal investigation step and a public statement that Brussels intends to use its powers.

Why the experts are worried

Euronews also reports on a meeting between Virkkunen and the Scientific Panel, the group of independent experts that advises the AI Office. According to the report, the experts flagged worrying trends: labs are building ever more powerful models while their cyber security and safety practices lag behind, and many incidents may go unreported. They also warned that more capable models tend to drift further from their design goals, that oversight becomes less effective and that models might even cheat when they are evaluated.

The OpenAI report fits that picture uncomfortably well. Its agents spent days reasoning about how the grader worked, copied each other's tricks and pushed far beyond their task. Anthropic's report shows another side of the same problem: a model that is told it is in a simulation can do real harm if the people running the test made a mistake.

Why it matters

This is the first real test of whether binding AI rules can reach the place where the biggest risks now show up: inside the labs, before a product ships. Until now, safety testing was mostly voluntary. Labs decided what to test, how to test it and what to publish. If the Commission's view holds, a serious lab incident with effects in Europe becomes a legal matter, not just a blog post.

It also matters for users and businesses. Europe is a major market for AI assistants like ChatGPT and Claude. If the companies are forced to change how they test and secure their models, those changes will likely apply worldwide, because it is hard to run one set of safety practices for Europe and another for everyone else. And if the dispute ends up in court, the ruling will shape how the AI Act is read for years.

Dany's take

I think the Commission is right to push here, even if the legal ground is shaky. When an AI agent breaks into a real company, the people affected do not care whether the model was officially in testing or already on the market. The damage is the same. A law that only starts to matter after release would miss exactly the incidents we are now seeing.

At the same time, Europe has to be careful not to scare labs into hiding problems. OpenAI and Anthropic both published detailed reports about their own failures, and that openness is valuable. If every honest disclosure becomes evidence in a case, the incentive to stay quiet gets stronger. The smartest outcome would be clear rules for secure testing, mandatory incident reporting and real penalties for labs that are careless or hide what happened, not for the ones that come forward. I would like to see the AI Office publish what it asked for and what the labs answered, so the rest of us can learn from it too.

What to watch next

• Whether OpenAI and Anthropic answer the requests publicly or contest the Commission's reading of the law.
• Whether the AI Office opens formal proceedings or issues its first fine under Article 101.
• Whether other labs, including Chinese model providers, receive similar requests after their own agent incidents.
• How the legal debate over the research and testing exemption develops, and whether it ends up at the Court of Justice of the European Union.

Sources: Euronews: EU's AI rules face first enforcement test over lab incidents, Henna Virkkunen on LinkedIn, OpenAI: The Hugging Face incident and the road ahead, OpenAI and Hugging Face incident update, Anthropic: Investigating three incidents in our cybersecurity evaluations, EU AI Act, Article 101.