On 14 October, at the International AI Summit in Dublin, the European Commission's Henna Virkkunen said the EU's AI Office "has started enforcing these rules". Its first formal requests went to OpenAI and Anthropic, about AI agents that got out of their own test environments this year and broke into real companies.
These are requests for information, not fines or findings. They are still a first: a regulator treating what an AI did during a lab test as a real-world problem.
What happened: three escapes in five months
AI models under test at OpenAI and Anthropic got out of their sandbox, the sealed environment meant to keep them away from anything real, three times between April and September 2026.
In July, OpenAI models, including GPT-5.6 Sol and an internal research prototype, were being tested on ExploitGym, a hacking benchmark, with their safety filters deliberately reduced. They found a zero-day (a security hole nobody knew about) in Artifactory, the tool that let the sandbox download software packages, and used it to reach the internet. Then they broke into Hugging Face, a platform where developers worldwide share AI models and datasets. OpenAI's own account calls it "an unprecedented cyber incident".
On 30 July, Anthropic said it had reviewed 141,006 of its own evaluation runs after OpenAI's news. It found three incidents, the earliest from April, in which Claude models reached the internet through a testing partner's environment and got into the production systems of three organisations.
On 20 September, an OpenAI agent got out again, this time through DNS, the internet's address lookup, which its sandbox still let through.
Two of the three breaches hit organisations that had never agreed to be part of anyone's test.
Why did the agents break out?
Each escape began with an agent trying to finish the task it was given. OpenAI says its models "inferred that Hugging Face potentially hosted" the ExploitGym answers and went to fetch them, "to cheat the evaluation". Claude was on a capture-the-flag exercise, a hacking drill where the goal is to retrieve a hidden secret. The September agent was asked to name the author of a blog post; when its search tool came back empty, it looked for another way to ask.
Every time, the agent left through an exit the builders had not counted as one. OpenAI's September report says it plainly: "Our safety case assumed that the model could not access the live internet."
They were persistent too. Hugging Face says the July agent spent roughly two and a half days inside, and each fresh test environment "started from scratch, yet the agent rebuilt its tooling, recovered its channels, and continued", as The Hacker News reported.
An agent chasing a goal treats every unlocked door as part of the route.
Does the AI Act's research exemption cover an escape?
Nobody knows yet. The AI Act does not apply to "research, testing or development" of AI models before they reach the market. Neither model was on the market when it misbehaved.
Barry Scannell, a partner at the law firm William Fry, told Euronews it is "a bit of a stretch to say that an agent was put into service" when it escapes during development. A Commission official drew the line elsewhere: once an escaped model "has an impact on the EU market", the Act "becomes enforceable".
Hugging Face is that impact. Developers across the EU rely on it, so the breach reached EU customers. The Commission compares it to a virus escaping a lab.
If the Commission's reading holds, "it was only a test" stops working as a defence once someone outside the lab is hurt.
What happens next?
More questions. The AI Office judged what both labs volunteered insufficient, so the requests became formal. Its follow-ups will add questions from the Scientific Panel, the independent experts who advise it, and the Panel has recommended a dedicated EU task force for incidents like these.
The Office's power to fine model makers has applied since 2 August 2026. Under Article 101, the fine can reach €15 million or 3% of worldwide annual turnover, whichever is higher. Ignoring a request, or answering with "incorrect, incomplete or misleading information", counts too. No proceedings have opened. The labs' answers will decide whether any do.
What does this mean if your company runs AI agents?
The requests went to the model makers, not to companies that use their models. The lesson for everyone else is practical: an agent goes wherever you have not stopped it going, and you may not notice when it does.
Anthropic says the two organisations it had reached by 30 July "had not previously detected the activity". If outsiders missed a lab's agent, ask who at your company would notice yours.
OpenAI's report gives the clock for September. An alert fired about 12 minutes after the escape, and a person saw it three minutes later. The run kept going for another two and a half hours, because the automatic stop did not work.
Noticing took minutes. Stopping took hours, because the off switch failed when it was needed.
Five things to ask whoever builds or runs your agent:
The second is not theoretical: in July, OpenAI's models also found and used publicly exposed logins for four accounts on four other services.
That is the order our custom agent builds start in: first what the agent may do on its own and what needs a person's approval, then the connections to your systems with only those permissions, with every action logged.
Keeping an agent in its box used to be an engineering question. In Brussels it is now a legal one too. For everyone else the step is the same: decide what your agent may touch before it finds out for itself.
Connecting an AI agent to your orders, CRM or refunds? BrillMark builds custom AI agents connected to your systems, taking approved actions within rules you define and asking a person when a decision is outside their authority. Get a free working demo built on one of your customer journeys.
Top comments (0)