FTC Subpoenas AI Companies Over Security Breaches Amid Shifting White House Policy

FTC Seeks Ideas to Prevent Misuse of AI-Enabled Voice Cloning

The Federal Trade Commission (FTC) on Wednesday (Oct. 14) sent civil subpoenas to OpenAI and Anthropic seeking documents related to a series of recent safety and security incidents in which the companies’ artificial intelligence (AI) agents accessed corporate and government systems without authorization. First reported by Axios on Oct. 9, the subpoenas ran to more than 50 pages each and sought marketing materials and documents detailing company privacy policies in addition to documents related to the security incidents.

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    Subscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    The FTC probe, which could potentially lead to litigation, comes as the Trump administration steps up scrutiny of AI companies even as it officially maintains a hands-off regulatory policy. On Thursday (Oct. 15), the White House AI task force, which is co-chaired by FTC Chairman Andrew Ferguson, held its first official meeting at which it agreed to commission a report from the President’s Council of Advisers on Science and Technology on the risk posed by AI to cybersecurity, critical infrastructure and biosecurity, and to evaluate AI companies’ model control and accountability, according to Semafor.

    The commissioning of the report comes after Anthropic notified the State Department last week that one of its test models had submitted 19 non-immigrant visa applications in August through the publicly available form on the department’s website. In response, the White House task force said it would now mandate AI companies to promptly notify it of any “fraudulent” use of government systems and take immediate remedial steps.

    “This notification and remediation process is not optional,” the task force leaders said in a statement provided to Axios last week. “It is a critical national security obligation.”

    However, it’s unclear what consequences, if any, would befall AI companies if they fail to act promptly to notify and correct any breaches. The task force has no formal enforcement authority, and its charter lasts for only 120 days. Moreover, the purported disclosure mandate comes barely two weeks after the White House touted a voluntary agreement with leading AI companies calling for internal and external safety reviews of AI models but leaving it up to the AI industry to police compliance.

    We’d love to be your preferred source for news.

    Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

    Adding to the uncertainty over the administration’s position, the FTC’s Ferguson told Reuters in September he thinks AI companies should be held liable for harms caused by their models.

    “If someone tells a tool to do something, and the tool does it, I don’t think we would say, ‘Oh, what do we do about the tool?’” he said.

    He also rejected claims that the recent security breaches were the result of AI agents acting truly autonomously.

    “Artificial intelligence companies have sometimes described systems as acting beyond human control, but subsequent reviews of audit trails have shown that the systems were carrying out instructions they had ⁠been given,” he said.

    At the same time, he told the news agency the “U.S. should utilize existing legal tools” to regulate AI firms, and that no new legislation or regulation is needed. He noted that the FTC has broad “authority to take action against companies that fail to disclose data breaches,” as now reflected by the subpoenas issued this week.

    The bottom line appears to be that the “voluntary” accord between the Trump administration and the leading AI companies will nonetheless be buttressed by non-voluntary official oversight.

    “Throughout its work, the [task force] will engage with frontier model developers and other SI companies, consumer protection groups, and civil liberties advocates, industry stakeholders, and federal and state law enforcement agencies to inform and implement its efforts,” a White House official said in a statement provided to Semafor. “The [Super Intelligence Force] stands ready to ensure implementation of the Accord and continued U.S. leadership on SI for the benefit of the American people.”