Report: FTC sends OpenAI and Anthropic more than 50 pages of questions

The Federal Trade Commission has reportedly demanded safety and security records from OpenAI and Anthropic, escalating a confirmed investigation into whether AI companies put consumers at risk. ^{[1] [2]}

The agency sent the two developers civil investigative demands on October 14, according to an unnamed source familiar with the matter cited by Axios, whose findings were relayed by Ars Technica. The demands reportedly contain more than 50 pages of questions about safety incidents, internal security measures and potentially misleading marketing. ^[1]

An FTC spokesperson previously confirmed that the agency was investigating OpenAI, Anthropic and other AI companies over possible risks to consumers. CBS News said the investigation began in the summer and concerns possible violations of the FTC Act, the agency's central consumer-protection law. ^[2]

The reported demands would move that inquiry into formal evidence-gathering. They could also bring scrutiny beyond the developers themselves: the source said third parties targeted by the companies' AI agents might be subpoenaed, and executives could be compelled to testify. ^[1]

The investigation comes amid a political push for industry self-policing. President Donald Trump has dismissed extreme claims about AI risks as a "hoax," according to Ars Technica. Yet FTC Chair Andrew Ferguson has said existing law could give the agency a route to act against AI companies. ^[1]

What the FTC is seeking

The reported questions span three connected areas: what happened when systems caused safety concerns, how companies protected their own operations, and what they told consumers about their products. The source described requests about recent incidents, security measures and marketing that could have misled users. ^[1]

Those subjects could let investigators compare a company's public assurances with its internal knowledge. A promise about a product's safety can be examined alongside records of how that product behaved. The inquiry's focus on both incidents and marketing gives the agency a way to investigate that gap, if one exists.

Ars described incidents involving AI agents acting on outside websites and government systems during testing, including cases involving OpenAI and Anthropic. AI agents are systems designed to take actions, rather than simply produce an answer for a user to read. Their actions can therefore affect people and organisations outside the company running a test. ^[1]

That helps explain the possible interest in third parties. A developer's records describe its own handling of an incident. Evidence from an affected organisation could help establish what actually reached an outside system and what consequences followed. The source's account suggests the agency may seek both perspectives. ^[1]

The demands have not been made public, and the FTC did not provide them to Ars Technica. Their exact legal scope, the incidents and periods covered, and any recipients beyond the two named companies are therefore unknown. OpenAI and Anthropic have not responded to requests for comment. ^{[1] [2]}

A demand for evidence, not a verdict

A civil investigative demand is a formal tool for collecting evidence before the FTC decides whether to bring a case. It is not a finding that a company broke the law, and receiving one does not itself impose a penalty.

The practical power is nevertheless substantial. Such demands can require a company to supply records and information, rather than leave disclosure entirely to its choice. According to the source cited by Axios, the agency may also compel testimony from AI executives and seek evidence from outside parties through subpoenas. ^[1]

The distinction between investigation and enforcement matters for the financial stakes. Ars reported that possible penalties could be comparable to fines imposed on companies that delay reporting data breaches. No fine or enforcement action has been announced in this probe. ^[1]

Ferguson told Reuters, according to Ars, that existing legal tools could apply to AI companies and that FTC authority over failures to disclose data breaches might reach AI developers. That opens a question about incident handling as well as the underlying behaviour of a system: what did a company need to disclose, and when? ^[1]

Any enforcement case would still have to connect the facts investigators gather to a legal duty. An alarming test result and a failure to meet a disclosure obligation are different propositions. The investigation is the process for establishing whether the second followed the first.

Self-policing meets compulsory disclosure

The administration's preference for industry self-policing sits alongside an agency inquiry that could require companies to surrender internal evidence. Both can operate at once, but they give developers very different control over what becomes visible. ^[1]

The FTC's approach also puts existing law at the centre of AI oversight. Ferguson's comments point toward using consumer-protection and breach-disclosure powers rather than waiting for a new AI-specific statute. The reported demands would give the agency evidence with which to test that approach. ^[1]

For consumers and organisations affected by AI systems, the immediate stakes are concrete: whether companies accurately describe their products and properly handle incidents when something goes wrong. Those are the questions the reported requests appear designed to investigate. ^[1]

The immediate question is whether the FTC will confirm the October 14 demands described by the source cited by Axios, and set out the legal obligations it is investigating. ^[1]