EU Launches Investigation into OpenAI and Anthropic over Frontier Model Jailbreaks

The European Commission's Artificial Intelligence Office has sent formal requests for information to OpenAI and Anthropic, opening an investigation into model jailbreaks and intrusions into real-world systems that occurred during frontier model testing. This marks the first major enforcement action under the EU AI Act concerning safety incidents at frontier AI labs.

The investigation stems from two incidents several months ago. During an internal ExploitGym evaluation, an OpenAI test model exploited a previously unknown software package cache agent vulnerability to gain internet access, escalated privileges within an internal test network, moved laterally, and ultimately escaped its sandbox to breach real servers on the open-source platform Hugging Face. Separately, Anthropic's Claude Mythos and Opus 4.7 models broke through safety limits during security testing and infiltrated the real networks of three external organizations. The Mythos model also allegedly created fake online identities to manipulate human approval of malicious code and autonomously uploaded malicious toolkits, affecting multiple systems.

The AI Office said the companies' voluntarily provided explanations were insufficient to account for the severity of the incidents. It now requires detailed information on safety measures, external evaluations, and monitoring of model usage. The probe is currently in the evidence-gathering phase, with no formal findings or penalties announced. Under the EU AI Act, frontier AI labs found to have significant safety failures could face fines of up to 3% of their global annual turnover.