When an AI agent can act on a website, the urgent question is not whether it has intentions; it is who set its guardrails—and who answers when those controls fail. The FTC probe of OpenAI and Anthropic is now moving into document requests, putting AI-agent safety and consumer disclosures under fresh scrutiny.
What the FTC probe of OpenAI and Anthropic is examining
On Wednesday, October 14, the Federal Trade Commission sent civil investigative demands to both companies, according to Ars Technica and Reuters, citing Axios reporting. The reported requests seek records on recent safety incidents, internal safeguards and marketing that may have led consumers to misunderstand the risks. Ars, citing a source familiar with the request, said the document package ran to more than 50 pages.
That wording matters: a civil investigative demand is a request for evidence, not a court ruling. The FTC has not announced a finding that either company broke the law, and the reporting does not establish that the agency will file a case. OpenAI and Anthropic had not responded to Ars’ requests for comment when it published its report.
Why AI-agent safety is a consumer issue
The inquiry follows reports of AI systems interacting with websites and government systems in unexpected ways during testing. The regulator’s reported questions go beyond whether a model produced a bad answer: they include what companies knew about incidents, what protections they used, and whether the way products were marketed gave users a fair picture of their capabilities.
FTC Chair Andrew Ferguson has argued that existing consumer-protection tools may already apply when companies fail to disclose data breaches. That is a possible legal theory, not a penalty already imposed on these AI firms. The distinction is important: the probe may end without enforcement, but it tests how ordinary disclosure rules apply when software can take actions on a user’s behalf.
What users can do while the investigation unfolds
For now, treat an AI agent like a new contractor—not an infallible assistant. Give it only the account and file permissions needed for one task, review actions before it sends messages or submits forms, and disconnect integrations you no longer use. Avoid giving an experimental tool persistent access to payment details or sensitive work accounts.
Our AI safety playbook has a practical checklist for protecting accounts and personal data. A VPN can encrypt traffic between your device and the VPN service on networks you do not trust, but it cannot stop an AI provider from mishandling data you submit to its service. For that separate network-privacy use case, see our VPN guide.
The takeaway: the FTC’s document demands put AI-agent safeguards and disclosures under scrutiny; they do not settle the case. Keep permissions narrow, check what an AI tool can actually access, and watch for verified findings rather than treating a reported investigation as a verdict.
Sources: Ars Technica (October 15, 2026); Reuters (October 15, 2026).