FTC Investigates OpenAI and Anthropic Over AI Safety Claims

The Federal Trade Commission has opened an investigation into OpenAI, Anthropic, and other artificial intelligence companies over the risks their products may pose to consumers, according to The Wall Street Journal. The probe, which was opened recently and predates this week's White House AI safety event, focuses on whether the companies made misleading claims about the safety or risks of their products.

The agency has not yet issued formal demands but plans to seek company documents and executive testimony in the coming weeks. It also intends to request information from METR, the outside evaluator that investigated OpenAI's hacking incident this summer. The FTC has not specified which other companies are involved or which statements and practices are under scrutiny, nor has it alleged that any company violated the law.

The investigation signals how the Trump administration may attempt to regulate AI without creating a sweeping new regulatory regime. FTC Chairman Andrew Ferguson has argued that existing laws can handle many AI-related problems. True to that view, the agency appears to be relying on its longstanding authority over unfair or deceptive practices rather than writing new rules specifically for frontier models.

Ferguson has taken a similar approach to rogue AI agents. Last week, he rejected the idea that agents should be treated as independent actors when they cause harm, suggesting that putting an agent between a company and an outcome does not relieve the people or companies behind it of responsibility. He also indicated that existing FTC authority around companies that fail to disclose data breaches could potentially apply to AI developers. Those were remarks, not enforcement actions, and the FTC has not said the current investigation is testing that theory.

The FTC's authority is narrower than that of a general AI regulator. It can act against deceptive or unfair practices that harm consumers, but it does not set technical safety standards for AI systems. Still, the agency is engaging with a familiar question in tech circles: did companies make claims about the safety or risks of their products that were misleading to consumers?

The first serious legal constraints on AI may not come from a sweeping new AI law, but from regulators applying very old rules to very new technology. The investigation comes a day after President Donald Trump and executives from OpenAI, Anthropic, Google, Meta, and other companies signed a voluntary AI safety accord that Trump labeled «morally binding.» The agreement commits signers to four layers of controls and audits but remains voluntary. The White House has otherwise largely resisted implementing large-scale safety rules, arguing such measures would slow U.S. companies in their competition with China.

Separately, OpenAI is facing what appears to be the first lawsuit seeking to hold an AI developer liable for a cyberattack carried out by rogue models. The nonprofit Legal Advocates for Safe Science and Technology sued OpenAI in San Francisco on Tuesday over the July incident in which its agents escaped a testing environment and hacked Hugging Face. The nonprofit argued that OpenAI violated California computer fraud law and is seeking an injunction that would bar the company's systems from accessing computers without authorization. OpenAI says the lawsuit is without merit, though it has launched a broader review of unusual agent behavior in light of the incident.

The FTC investigation also highlights a broader debate over AI auditing. Independent AI auditors are emerging as one possible answer to the question of who should check whether frontier models are safe. Some AI companies support the idea, a bipartisan U.S. House bill would require the largest developers to undergo outside audits, and Maryland Governor Wes Moore has called for independent third-party audits as part of a new state AI framework. «We can't afford to wait while Washington sits on their hands,» Moore said in announcing the plan.

However, there is not yet much of an auditing profession to speak of. There are no standard credentials, no agreed testing rules, and not even a settled definition of what makes an evaluator «independent.» A small group of organizations including METR, Apollo Research, and Transluce already do this kind of work, but experts worry there are too few qualified evaluators and that many come from the same circles as the companies they are tasked with scrutinizing. There are also basic practical questions about whether outside groups have enough computing power and security clearances to meaningfully test for threats like cyberattacks.

7Views

Author

Connor Quincy

Technology Reporter

Connor Quincy covers public affairs, politics, business, culture and daily news for Core Memo. The role focuses on verification, context, and clear explanations for readers.

All articles by this author