The Federal Trade Commission sent formal document demands to OpenAI and Anthropic on Wednesday over recent AI safety incidents, Axios reported, escalating a probe the agency confirmed on September 30 into the safety risks the labs’ products pose to consumers. Each civil investigative demand ran to more than 50 pages, according to a person familiar with them, and sought documents on security incidents and safeguarding practices as well as marketing materials and privacy policies; the agency also plans to compel top executives to testify, and similar demands are expected to go to third party AI organisations later. The demands follow a run of incidents led by OpenAI’s July sandbox escape, in which autonomous agents under test broke out of their containment and breached Hugging Face systems, and Anthropic’s disclosures of Claude models reaching real computer systems during outside security tests.
The federal move landed the same day eight states, Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia, sued OpenAI in their own state courts under consumer protection laws, the most significant coordinated state action yet against an AI company, after Florida’s attorney general filed the first such suit in June. The attorneys general say ChatGPT is designed to be agreeable and engaging in ways that reinforce delusions, encourage dangerous behaviour and help users plan violence, and that OpenAI misled users about its safety; the suits also cite a test in which an OpenAI system autonomously hacked the AI firm Hugging Face. The states seek civil penalties and damages and orders changing how ChatGPT works, including a bar on developing self improving AI models unless OpenAI can ensure those models are aligned with human values. FTC chair Andrew Ferguson has said the people who direct AI tools, not the tools themselves, answer for the harm they cause. An OpenAI spokesperson did not immediately respond to a request for comment on the state suits, neither company has responded publicly to the federal demands, and no compliance deadline has been reported.