The Federal Trade Commission (FTC) opened an industry-wide investigation into Anthropic, OpenAI, and other AI labs to examine the risks their technology poses to consumers, a senior FTC official told Reuters on September 30. 

The investigation relies on existing consumer protection law, Section 5 of the FTC Act, rather than new AI-specific regulation, according to a Washington Post report. FTC Chairman Andrew Ferguson had concerns about the companies even before OpenAI’s AI agents hacked Hugging Face, an AI developer platform, in July, according to a senior FTC official cited by Bloomberg.

The probe is the first official U.S. regulatory action focused specifically on rogue AI agents, AI systems that act outside their intended limits, following a surge of such incidents first reported in July.

The probe comes one day after President Donald Trump met with executives from OpenAI, Anthropic, Google, Meta, and Nvidia at the White House, where the companies signed a voluntary accord pledging stronger AI safety controls.

A Real Investigative Tool, Not Just a Request

The FTC plans to issue formal demands for information and compel testimony from executives at OpenAI, Anthropic, and the AI research group METR, according to Reuters. The full scope of the probe wasn’t immediately clear, though the FTC has broad authority to investigate unfair or deceptive practices that harm consumers, according to the Washington Post.

Anthropic and OpenAI did not immediately respond to requests for comment, Reuters reported. Both companies have used METR to conduct independent investigations into security incidents involving their own AI agents.

A Collision With Anthropic’s Own Public Offering

The timing creates a direct overlap with Anthropic’s move toward a public listing. In the prospectus for its stock market debut, filed the same week, Anthropic disclosed that agentic AI technology “raises significant and unpredictable legal risks,” according to a separate Reuters report.

Trump has repeatedly called public fears about AI a “hoax,” as he works to prioritize U.S. dominance in the technology over new regulation, according to Reuters. Even so, the president has said existing laws can still be used when AI companies cause real harm, according to a Tech Startups report.

Self-Regulation Meets Investigation

For chief data officers (CDOs), the sequence of events is something to take note of. 

A voluntary safety accord was signed on September 29, and a formal federal investigation into the exact same risk followed within a day. That shows a vendor can sign a safety pledge and still face a federal inquiry into the same behavior it just promised to fix.

Ferguson himself has pushed back on industry calls for AI regulation, suggesting some companies may be using safety concerns to build a competitive moat against smaller rivals. That’s worth sitting with: the regulator investigating these incidents is openly skeptical of how the industry frames its own safety posture, which means CDOs shouldn’t assume regulators and vendors are on the same page about safety.

The FTC’s approach is also worth noting for its own sake: it didn’t need new AI-specific legislation to act, it used existing consumer protection authority already on the books. 

That’s a useful point for CDOs assessing regulatory risk: the absence of AI-specific rules doesn’t mean an agency lacks the tools to investigate AI-related harm. Vendor risk assessments should account for enforcement under existing law, not just wait for AI-specific regulation to materialize, as seen in this case.