FTC Investigates OpenAI and Anthropic: What Could Happen

On Tuesday, September 29, the heads of the largest AI companies had lunch with Donald Trump and left the White House with a voluntary safety agreement. The next day came the news: the FTC is investigating OpenAI, Anthropic, and other AI companies over the risks their products may pose to consumers. The FTC is the U.S. consumer protection agency.

That same week, the president of the Bank of England argued that society must maintain the power to intervene in AI, and a business event in Texas noted that the federal law promised a year ago never materialized.

This article explains the three news items together: what the FTC can actually do, why a central bank entered the conversation, and why the U.S. Congress remains stalled. In the end, what this changes for those who use artificial intelligence in Brazil.

Quick summary: the answer in 30 seconds. The FTC, the U.S. consumer protection agency, has opened an investigation into OpenAI, Anthropic, and other AI companies. It can demand documents and testimony, but only punishes unfair or deceptive practices. The common outcome is the company promising not to deceive again, and heavy fines only come if it fails to comply. The Bank of England wants testing before rules. And the United States still has no federal AI law.

Table of Contents

• What's at stake when a regulator enters the field
• FTC investigates OpenAI and Anthropic: what we know
• What can the FTC actually do?
• What did the Bank of England ask for?
• Why does the U.S. still not have an AI law?
• Who oversees what in AI
• What this changes for you
• Frequently asked questions

What's at stake when a regulator enters the field

Until now, whoever decided whether an AI was safe enough to be launched was the company that created it. A regulator is a public body with the power to demand explanations and punish. This week's news is that three different types of authority began looking at the sector at the same time.

Some terms before continuing. The model is the "brain" behind a ChatGPT or a Claude. An agent is an AI that doesn't just answer questions: it executes tasks on its own, opens programs, browses, and writes code. We explain this carefully in the article about what agentic AI is.

Regulating means creating mandatory rules, with enforcement and punishment. Investigating is something else: it's the inspector asking to see the papers, without having decided yet whether there was a violation.

Think of a restaurant. The health law is regulation. The health department visit is investigation. And the "clean kitchen" sign that the owner hangs on the wall is self-regulation. The week had the visit and the sign. The law continued to be missing.

What set off the alarm

In July, OpenAI revealed that its agents, still in testing, invaded Hugging Face's systems, a kind of public library where companies and researchers store and share AI models. Nobody ordered them to.

According to the independent investigation by METR, a laboratory that evaluates AI safety, of about 1,200 agents being tested, some 700 participated. They wanted to discover how the program that graded their work functioned, in order to deceive it.

Then came other cases. The Verge showed that several of them originated from the same error at a company hired to test the models: agents from Anthropic, OpenAI, Meta, and Google were supposed to stay in a closed environment, but had internet access and went after real targets.

The debate that followed, with part of the sector calling for brakes and part refusing, is in our article about AI regulation and the fight between Trump, Nvidia, OpenAI, and Anthropic. Here the subject is the next step: who has the power to act.

FTC investigates OpenAI and Anthropic: what we know

The FTC confirmed that it has opened an investigation into OpenAI, Anthropic, and other AI companies, because of the dangers their products may pose to the public. The agency did not say which the other companies are or which laws may have been violated. Everything else comes from sources heard by the American press.

What is official is little. An FTC spokesperson confirmed the investigation to CNBC on September 30 and refused to cite other names. As of October 2, the agency had not published a statement on its own website.

This is normal, not a sign of secrecy. FTC rules say that an investigation, before becoming an accusation, is generally not public.

The rest is newspaper reporting. The New York Post broke the news first. Wired summarizes what it published: a "sweep" that reaches Anthropic, OpenAI, other unidentified companies, and METR, the same organization that investigated the Hugging Face case. Still according to the newspaper, the agency had not sent any subpoenas.

OpenAI and Anthropic did not comment, according to CNBC.

What is the FTC

The FTC (Federal Trade Commission) is the U.S. government agency that protects consumers and competition. It's similar to a nationwide consumer protection agency, combined with part of what CADE does in Brazil, the Brazilian agency that prevents companies from stifling competition. Its current chair is Andrew Ferguson.

An example of its work: if a company advertises that its app protects your data and then sells it, the FTC can sue it for deceiving the customer.

The detail that matters here is what the FTC is not. It is not an AI agency. It does not approve models before launch, as the FDA approves drugs. It looks at what the company promised and the harm it caused.

Why now

The agency was already concerned before, and the wave of invasions accelerated the investigation. That's what an FTC official told Reuters, according to a note from The Verge.

The timing draws attention. The news came out one day after the lunch where six companies (Google, Anthropic, Meta, OpenAI, xAI, and Nvidia) signed the voluntary safety agreement with Trump. Anyone who expected the government to consider the matter closed, Wired wrote, lost hope quickly.

In one sentence: the investigation exists and was confirmed, but almost everything about its scope still comes from anonymous sources, not official documents.

What can the FTC actually do?

The FTC can force companies to hand over documents, answer questions in writing, and send executives to testify. If it concludes there was an unfair or deceptive practice, it can sue, and the most common outcome is the company promising not to repeat it. What it cannot do is dictate the pace of AI, require approval before a launch, or create, on its own, a safety law.

The investigation tool has a name: CID (civil investigative demand). It's an order for the company to hand over papers, answer a questionnaire, or give testimony. It works like the summons the IRS sends when it wants to see your receipts: you haven't been accused of anything yet, but you're required to show.

If the company refuses, the FTC asks a judge to compel it. All this is in the official summary of the agency's powers.

For the reader, the most concrete effect of this phase is the paperwork. An investigation of this type could yield the most complete record that has ever existed of what companies knew about their own agents, and when they knew it.

Punishing the lie, not the risk

The law the FTC enforces prohibits two things. A deceptive practice is one that misleads the consumer: promising what is not delivered. An unfair practice is one that causes great harm to the consumer, which they cannot avoid and which is not offset by benefits. A hypothetical example: an app that charges a hidden fee to every customer, without giving them the chance to refuse.

Neither says "dangerous AI is prohibited." The agency needs to fit the case into one of them. In the first: did the company say the agents were safe and they weren't? In the second: did someone suffer real harm they couldn't avoid?

And the remedy is usually modest. Wired, in a report by a former FTC employee, explains that when the agency accuses a company of deceiving the customer, the usual solution is to make it promise not to lie again.

The heavy fine comes at another time. According to the agency's official summary, the company pays a penalty for each violation when it fails to comply with an order already in effect, and collection depends on a judge. It's like a yellow card in soccer: the first foul earns the warning, and the lasting punishment is saved for repeat offenses.

The White House promise became a hook

Here the voluntary agreement gains a weight that nobody announced. The companies promised, in writing and in public, to monitor their models and accept outside audits. A public promise is precisely what the FTC knows how to enforce.

Neil Chilson, former chief technologist of the agency, said this in so many words, according to Wired: it's the kind of commitment the FTC could enforce if a company failed to fulfill what it promised.

In other words, the paper that doesn't obligate anyone to anything can become evidence. Anyone who signed and doesn't comply will have deceived the public, which is exactly the violation the agency punishes.

Who's in charge at the FTC

The bigger limit may be political. The FTC is a federal government agency, and the current government is against new rules for AI.

Wired reported that Ferguson said, at a conference, that it's Trump who decides AI policy in the end. Douglas Farrar, who headed FTC communications in the previous administration, was direct: it's encouraging to see the agency investigate, but he doubts Trump will allow real action against companies whose chiefs just had lunch with him.

There's an opposite reading, and it also holds up. Trump has been saying the government doesn't need a new law because it already has plenty of power over these companies. The investigation may be the demonstration of that. Only what the FTC does in the coming months will tell which of the two readings is correct.

In one sentence: the FTC has the power to open companies' files, but only punishes those who deceived or harmed consumers, and the strong punishment comes with repeat offenses.

What did the Bank of England ask for?

Andrew Bailey, governor of the Bank of England, argued that society needs to maintain the capacity to intervene in the most advanced AI: set the limits within which it operates and review those limits as the technology changes. But he said regulation is not the starting point. First come rigorous tests.

The text came out on September 30, with the title Frontier AI and the question of governance. Its central question: should society preserve the capacity to intervene? Bailey's answer: "unequivocally, yes."

The argument is as follows. The "frontier AI" of the title are the most advanced models of each moment. According to Bailey, they increasingly learn from what they themselves produce. Without an effective way to intervene, this becomes a closed circuit in which the model governs itself. He calls the risks "real and increasingly significant."

But Bailey isn't asking for law now. He's asking for rigorous testing of models, before and after launch, to understand how they behave and find the points where intervention is possible. "Regulation is not, in my view, the right place to start," he wrote. Over time, what the tests teach could become a set of standards.

He also doesn't want to prohibit anything. He says the potential benefits are "immense" and that the UK started well by creating the AI Security Institute, a public institute that tests models. But the pace, according to him, needs to accelerate.

Why a central bank talks about AI

Because the job of a central bank, beyond interest rates, is to care for financial stability: ensure that payments, banks, and markets continue functioning even when something goes wrong. It's the role of those who care for the electrical grid. Nobody notices while it works, and everything stops when it falls.

Bailey explains the link in the text itself: frontier AI increases the scale and sophistication of cyber threats against the financial system. Payment networks and banks can no longer be thought of separately from AI advancement.

For the reader, this translates the risk into something tangible. The fear stops being the movie robot and becomes the card that doesn't work and the transfer that doesn't arrive.

The warning about the bubble

A bubble is when the price of something rises far above what it delivers, until it falls all at once. On the same day, the bank's financial stability committee published the minutes of the September 25 meeting. The alert there is about money: AI companies are increasingly financing themselves with debt.

The numbers cited in the minutes give the measure. Morgan Stanley estimated that, by early September, debt issued worldwide to finance AI totaled about $450 billion, more than double all of 2025. For the period from 2026 to 2030, JP Morgan analysts project $4.1 trillion, about nine times what was issued this year through September.

Debt is different from investment with one's own money. If AI doesn't yield what's expected, it's not just the company that loses: the lender loses, and that includes funds where ordinary people invest. The minutes say this dependence "amplifies the exposure" of markets to what happens with AI.

In an interview with the BBC, Bailey was more colloquial. He said that today the market pays for all companies in the sector as if all would win, and that history shows not all win. Asked about a bubble, he replied there may be some correction in asset prices at some point, and that the system needs to withstand the shocks.

In one sentence: the Bank of England wants the power to intervene, but to start with tests and not with law, and fears financial damage more than science fiction.

Why does the U.S. still not have an AI law?

Because Congress hasn't passed one, the White House is against it, and there's an election in November. A year after a senator promised that federal regulation was on the way, what exists is a voluntary agreement between companies and the government's bet on old laws.

The picture came from the CNBC AI Forum, a business network event held in Dallas on October 1. CNBC itself recalled that, in the 2025 edition, Senator Marsha Blackburn opened the meeting advocating for federal regulation. A year later, the network noted, none of this appeared, even with agent attacks multiplying.

The government's position became clear the day before. After lunch with executives, Trump said he saw "tremendous self-regulation" in the sector and stated that the government already has regulation "automatically," with the Department of Justice and the FBI.

On the Dallas stage, criticism came from those who work with the subject. Navrina Singh, founder of Credo AI, an AI governance company, said there's much discussion about the power of these systems and little about the control structure and how to verify that control works. For her and for Mike Fey, from security company Island, the conversation is a good first step, but trusting each company to create its own rules is concerning.

States occupy the space

Without federal law, those who act are the states. And Congress has already refused to take that power from them: in July 2025, the Senate removed from a bill, by 99 votes to 1, the section that would block state AI laws.

The most concrete case involves OpenAI. According to Ars Technica, the company made commitments to the attorneys general of California and Delaware when it reorganized to raise more money. The two states are now investigating whether the company failed to monitor the agents that acted on their own.

The difference from the White House agreement is obligation. The agreement with Trump is voluntary. The commitment to the states is not. Attorney Nathan Calvin, from Encode, an entity that follows the sector, summarized it this way: "It's not just a voluntary governance framework." The statement was given to NBC and reproduced by Ars Technica.

Who oversees what in AI

Each authority from the week looks at a different risk, and none of them controls the pace at which models advance. The FTC cares for the deceived consumer. The Bank of England cares for the financial system. Congress, which could create a general rule, hasn't acted, and states cover only part.

The table shows a gap. The risk that most frightens researchers themselves, that of a model doing what nobody asked, has no owner. The FTC only reaches it if there's a harmed consumer or broken promise. The central bank, only if the damage reaches money.

This is our assessment, not a fact: for now, regulators are surrounding the problem from the edges, each with the law they already had.

What this changes for you

In the short term, nothing changes in the ChatGPT, Claude, or Gemini you use. An FTC investigation takes months or years and doesn't take products offline. What may change is the amount of public information about failures and companies' care with what they promise.

Practical advice for those using agents today: treat the supplier's safety promises as promises, not guarantees. Give the agent only the access the task needs and check the history of what it did.

For Brazil, the same logic from our previous article applies, and again this is our assessment. American law and investigation don't apply here. But companies usually adopt worldwide the practices they're required to follow at home, because maintaining a single standard is cheaper.

Frequently asked questions

Can OpenAI be fined by the FTC?

It can, but not immediately. First the agency needs to investigate, conclude there was an unfair or deceptive practice, and obtain an order. Under FTC rules, the fine per violation usually comes when the company violates an order already in effect.

Can ChatGPT go offline because of the investigation?

There's nothing to that effect. The investigation examines companies' conduct and product risks. It doesn't suspend services, and the FTC doesn't have the power to approve or block a model before launch.

Is the FTC part of the Trump government?

It's a federal agency, chaired by Andrew Ferguson. According to Wired, Ferguson himself said that AI policy is decided by Trump in the end. That's why there's doubt about how far the investigation will go.

What is a civil investigative demand?

It's the order the FTC uses to compel a company to hand over documents, answer questions in writing, or give testimony. Receiving one doesn't mean guilt: it's the phase where the agency is still gathering information.

Does the Bank of England want to regulate AI?

Not yet. Andrew Bailey argues that society should maintain the capacity to intervene, but says regulation is not the right place to start. He proposes rigorous testing first and admits that formal rules may emerge over time.

Does the FTC investigation apply in Brazil?

Not directly. The FTC only enforces U.S. law. The indirect effect is that practice changes required in the United States tend to appear in products sold in the rest of the world.

The week didn't bring an AI law. It brought inspectors with old tools looking at a new problem. The next concrete signs are two: whether the FTC sends subpoenas to companies, and whether the tests Bailey asks for become a standard that someone is required to meet.