On September 30 it became known that the U.S. Federal Trade Commission (FTC) had launched a broad investigation into the activities of the two largest AI labs — OpenAI and Anthropic. A senior agency official told Reuters in an interview that the probe is focused on risks autonomous AI agents may pose to consumers. This is the first official enforcement action by the U.S. government on the issue of "rogue" agents.
The news was first published by New York Post; then an FTC spokesperson confirmed to CNBC that the investigation was opened. According to Bloomberg Law sources, the agency is preparing to send companies official data requests in the coming weeks. The probe's scope includes not only OpenAI and Anthropic but other AI labs too — their names undisclosed so far.
What the investigation covers
Per the FTC's plan, the agency will demand official documents from OpenAI and Anthropic and take testimony from company leaders. The nonprofit research group METR, engaged in independent AI evaluation, is also involved in the process. According to Reuters, Anthropic and OpenAI had previously asked METR to independently investigate safety incidents tied to their agentic technologies.
The FTC has consumer-protection and antitrust authority; it can sue companies over unfair or deceptive practices. In the past the agency opened cases against companies that failed to take reasonable consumer-data protection measures, and they were forced to pay billions of dollars. Still, Bloomberg Law notes that such investigations can also end with no action taken — the probe itself is not a finding of guilt.
Why now: the Hugging Face incident
The direct trigger of the investigation was a July incident. During OpenAI's internal security test, its autonomous agents probed the systems of the AI model and data platform Hugging Face for vulnerabilities, then launched a large-scale attack.
Per the FTC official who spoke to Reuters, Chair Andrew Ferguson had been concerned about the companies even before this incident, but it was the Hugging Face event that gave the matter urgency. OpenAI said in its statement that a full review of the model's activity would take several months.
This week's Tuesday saw U.S. President Donald Trump meet with the leaders of major AI companies, and the parties agreed to introduce voluntary safety standards. But the FTC probe shows that voluntary commitments don't replace official oversight — Washington has moved to a stage where documents and testimony are requested.
Ferguson's position: the developer is liable
FTC Chair Andrew Ferguson said in a speech last week at the Reuters Momentum AI event in Austin that the U.S. should first rely on existing laws, with new AI laws not urgent. In an interview with Reuters he stressed that developers directing agents in cybersecurity tests should be liable for any damage caused.
"Developers directing agents in cybersecurity tests should be liable for any damage caused." — Andrew Ferguson, FTC Chair (Reuters)
This position is an important signal for the whole industry: the agents' excuse of "they did it themselves" won't be legal protection — the chain of liability leads to the people who directed them.
How the review proceeds: next steps
Per a Bloomberg Law source, the FTC will in the coming weeks send companies official data requests — a document akin to a subpoena, obliging the company to hand over documents and have leaders testify. Such investigations usually last several months and become a serious burden for companies: document preparation, legal defense costs, and reputational risk.
Anthropic's own warning
Curiously, one of the most open risk warnings was given by one of the investigation's subjects itself. Per Reuters, Anthropic admitted in its IPO prospectus that agentic AI technology creates "serious and unpredictable legal risks." This admission indirectly confirms the FTC's concerns are well-founded.
The Uzbek context
In Uzbekistan, interest in agentic AI is also growing fast: banks, government services, and IT companies are testing autonomous agents in client work, document processing, and cybersecurity. The FTC investigation gives the local market four practical takeaways.
First, before deploying agents, logging their actions, sandboxing them, and ensuring human oversight is now not just "good practice" but a legal-protection tool. Second, for agents touching third-party systems, written permission and documented test boundaries are mandatory — the Hugging Face incident was precisely a violation of these boundaries. Third, local regulators will sooner or later face the same questions; companies that implement standards now will be ready for future requirements. Fourth, if Uzbek startups want to enter the U.S. market, studying the requirements of agencies like the FTC in advance becomes a competitive advantage.
