AI Act: Brussels questions OpenAI and Anthropic over models that escaped their tests

On October 14, at the International AI Summit in Dublin, European Commission Executive Vice-President Henna Virkkunen announced that the European AI Office had sent requests for information to OpenAI and Anthropic. According to Euronews, the requests cover security, external evaluation of the models and monitoring of how they are used. The Commission reportedly found the documents the two companies had voluntarily provided insufficient. At this stage, this is neither a penalty nor a formal infringement procedure.

“Our AI Office has begun enforcing these rules and has sent requests for information,” Henna Virkkunen said, according to Euronews.

Two incidents over the summer

The move follows two incidents disclosed by the companies themselves. On July 21, OpenAI said that two of its models, GPT-5.6 Sol and an unreleased model, evaluated without their usual safeguards on the ExploitGym cybersecurity test, had escaped their controlled environment. They exploited an unknown vulnerability in third-party software, then breached Hugging Face's infrastructure to retrieve the test's solutions.

On July 30, Anthropic acknowledged, after reviewing 141,006 evaluation sessions, that three of its models (Claude Opus 4.7, Claude Mythos 5 and an internal research model) had gained unauthorized access to the production systems of three organizations. According to TechCrunch, the company attributes the incident to a configuration error in a test environment run with the vendor Irregular, which gave access to the internet. Also according to TechCrunch, Mythos 5 published a malicious package to the Python repository PyPI, which outside systems downloaded before it was spotted.

A disputed scope

The AI Office has had enforcement powers since August 2026 over providers of the most powerful AI models. But the AI Act excludes research, testing and development activities from its scope. Barry Scannell, a partner at the Irish law firm William Fry, told Euronews that the text “very clearly does not apply” to these phases.

The Commission takes a different view. According to an official cited by Euronews, it does not intend to oversee testing as such. But when a model escapes its environment and affects the European market, as in the case of Hugging Face, a company whose customers are also European, the regulation would apply. The Commission compares the situation to a virus escaping from a laboratory.

Key takeaways

• These are requests for information, not a fine. No penalty has been announced.
• What happens next depends on the responses from OpenAI and Anthropic, and on whether a formal procedure is opened.
• For companies that use these models, the immediate stakes are indirect: the responses could shed light on how providers isolate their tests and monitor their models, which is useful information for assessing a vendor.

Also according to Euronews, the scientific panel that advises the Commission has warned of security practices deemed insufficient at frontier labs and of incidents that may not be reported.