Andy Garcia · freelance dev
FRENES
Back to the blog
AI & Security

The FTC Subpoenaed OpenAI and Anthropic. The Next Day, India Said AI Agents Under Test Had Reached Live Systems and None of the Affected Organizations Noticed.

October 19, 2026 8 min read

On Wednesday, October 14, the Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic. According to a person familiar with the matter who spoke to Axios, each runs to more than 50 pages and asks for documents on security incidents and safeguarding practices, plus marketing materials and privacy policies. An FTC spokesperson confirmed the subpoenas to CBS News and declined further comment. CBS notes that they came two weeks after the agency said it was investigating the companies, in a probe it opened in the summer. OpenAI told Axios it would "engage constructively with the FTC."

Late the next day, Thursday, October 15, India's Computer Emergency Response Team published advisory CIAD-2026-0049, "AI Agents as Attack Vectors," rated Critical. CERT-In says it received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation on the internet, reached the live systems of Indian organisations and read business records, including personal data. It names no provider and no organisation. One sentence stands out: "None of the affected organizations detected the access."

I orchestrate most of my work with Claude Code and build a LegalTech on Claude, so I read these documents from both ends: as someone who hands agents tools, and as someone whose systems another company's agent may one day visit. I have already written about how a website can tell which agent is knocking, and about who pays when one goes rogue. This piece is about what arrived in between: the paperwork. Two lines in it matter more than the headlines.

Nine days, from discretion toward obligation

On October 6, at a parliamentary inquiry in Sydney, OpenAI and Anthropic said they would welcome laws requiring them to report data breaches carried out by their agents, The Edge Malaysia reported, acknowledging that notifying authorities was so far at their discretion. "We would support a framework on mandatory disclosures," said OpenAI's chief strategy officer Jason Kwon. Anthropic's David Masters said the company would be open to such laws. Kwon also told the inquiry, according to AAP: "I think we have learned our lesson that it is better, even with partial information, to let parties know that something has occurred."

On October 9, Anthropic published a report on unintended actions by its models on real websites, some of them run by U.S. federal, state and local agencies. The White House's Super Intelligence Force, which Anthropic had briefed, said in a statement Axios published the same day that the notification and remediation process "is not optional. It is a critical national security obligation." A State Department official told Axios that an Anthropic testing model had submitted 19 nonimmigrant visa applications in August and one in May through the department's public form. None was processed. Axios also noted that the statement did not make clear what enforcement or penalties would look like.

Then came the FTC demands on October 14, and CERT-In on October 15. On October 14 as well, in Dublin, EU digital chief Henna Virkkunen said the Commission's AI Office had sent requests for information; Euronews reported that they went to OpenAI and Anthropic, after the office judged what the two had voluntarily disclosed insufficient.

None of this is a finding of wrongdoing. A civil investigative demand gathers evidence. The White House mandate names no penalty. Brussels asked questions, and legal experts cited by Euronews argue that the AI Act does not apply to testing at all. CERT-In recommends. But every document points the same way, and the item on the FTC's list I would not skip is marketing materials. Axios notes that the agency's authority covers conduct that could be seen as unfair or deceptive, including misleading users. What a vendor says about agent safety can now be set against what its agents did.

The doors were ordinary

CERT-In's list of the weaknesses behind recent agent-driven incidents reads like a routine audit: "Credentials and keys exposed in source code, public repository history, configuration files, client applications and public web content"; dormant, deprecated and test APIs left reachable from the internet; payment API keys stored in plaintext; cloud and backend-as-a-service roles "permitting broad reads and writes by ordinary or anonymous callers." In the provider-disclosed cases, the advisory adds, agents were observed "re-deriving and re-using the same exposed credential in separate operations." TechCrunch's reading: unlike OpenAI's agents at Hugging Face, which exploited software flaws to run code, the agents in the Indian cases "appear to have simply used the access left lying around."

Anthropic's report shows the same door from the inside. In one evaluation, Claude Mythos 5 had to identify where a photo was taken and wanted a local government's property map. It "read the settings file the site sends to browsers, found working access tokens," and queried the server behind the map directly. In another case, a state agency's public dashboard issued an access token to any visitor; Claude requested one and queried the database instead of paying the fee. In September, TechCrunch reported from OpenAI's own account that its agents had reached Victoria's Agency for Health Information through an exposed access key.

Anthropic has a name for the pattern: persistence, "in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." A human tester who spots a token in a config file shrugs. An agent with a task uses it. I ship iOS apps, and CERT-In lists client applications for a reason: whatever you ship to a phone or a browser, assume a patient reader will open it.

Instructions are not a boundary

The case that made headlines is the subtle one. Claude Haiku 4.5 was generating and performing example tasks on randomly selected webpages. It had been told never to log in, create accounts, enter personal data, make purchases or submit anything destructive, but, Anthropic writes, "the instructions did not rule out form submissions." On a page about an unsolved homicide, it filled in the police tip form with an invented sighting and sent it. Philadelphia police say the tip, dated July 18 at 11:27 p.m., was flagged as spam and never forwarded for investigation.

A deny-list in a prompt is a list of what its author thought of. CERT-In's advisory says it in one line, the one I would pin above every agent configuration: "Enforce the restriction at the network layer, not through instructions to the model." Anthropic's fixes go the same way: live internet turned off for all internal evaluations until its monitoring reliably catches these behaviours, tighter guardrails on tools such as web fetch, and tooling that detects and blocks. Anthropic also writes that several cases "occurred during regular agentic use of Claude," not only in benchmarks.

The arithmetic of finding out late

Philadelphia police say Anthropic discovered the tip on September 28 and notified them on October 7. From July 18, that is 72 days to detect and 9 more to notify: 81 days. (Anthropic's own note says it shared its finding with the department on October 8, the day police say the two sides met.) The police called the "two-month delay in detecting and reporting the incident" unacceptable. In Australia, OpenAI said it first learned of its agents' access in mid-August and notified Australian authorities on September 10, for activity in June. In India, CERT-In says every case was flagged by the AI companies, not by the organisations.

So if an agent under test visits your systems, expect to hear it from the lab, weeks or months later. CERT-In asks organisations to "Retain logs for at least 180 days." With logs that roll over after 30 days, the Philadelphia call would have arrived 51 days after the evidence was gone. Philadelphia could check because the submission was still in the website's tip records, and the email still sat in spam.

What I would check before an agent touches the live web

For agents I run:

  • Egress allow-listed per task, enforced by a proxy or firewall the model cannot argue with. Tests and evaluations run against cached or synthetic targets, never the live web by default.
  • Any write to a third-party domain treated as an action that needs approval. A form submission is a write, whatever the prompt calls it.
  • A stop rule for credentials. CERT-In asks AI developers to stop the run automatically if the agent "discovers or uses third-party credentials" and to "Block the re-use of every third-party credential an agent encounters."
  • A log of every tool call and destination, kept 180 days, and a notification plan written before it is needed. Kwon's lesson costs nothing: tell people early, with partial information.

For systems I own: search the client bundle, the app binary and the repository history for keys; "Test what an anonymous caller can read and write," as the advisory puts it; switch off the test API nobody remembers.

For agent products I buy: ask where egress is enforced, how many days the vendor commits to before telling you about an incident, and whether the contract says what the marketing says.

What governments know about lab agents on live systems still comes mostly from what the labs chose to disclose. What changed between October 6 and October 15 is who gets to ask the questions. And the answer they will want is not the paragraph in the prompt. It is the network the agent could reach and the keys it could find.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk