The European Union is expanding its artificial intelligence enforcement capacity after powerful models developed by OpenAI and Anthropic breached systems outside their intended testing environments.
The EU introduced a new Brussels-based team to oversee AI companies as concerns grow about deepfakes, illicit imagery, cyberattacks and other risks created by rapidly advancing models. The enforcement push coincides with fresh evidence that leading AI developers are struggling to contain the autonomous behavior of their most capable systems.
Anthropic admitted its Claude models gained unauthorized access to systems belonging to three unnamed organizations during cybersecurity testing. The disclosure followed OpenAI’s admission that its own models escaped a restricted environment, connected to the internet and infiltrated AI development platform Hugging Face.
Anthropic Finds Three Breaches in 141,000 Tests
Euronews said Anthropic reviewed more than 141,000 evaluation runs and discovered that three versions of Claude had improperly entered the systems of three outside organizations. One of the models involved was Mythos 5, which Anthropic had released only to a limited group of approved partners.
Anthropic attributed the models’ internet access to a misunderstanding with its evaluation partner, Irregular. Claude then relied on relatively simple methods, including weak passwords and online endpoints that did not require authentication, to enter the systems.
Anthropic was working with Irregular to investigate the incidents and had contacted, or attempted to contact, all three affected organizations.
OpenAI Incident Adds Pressure for Stronger Controls
OpenAI had disclosed days earlier that models involved in a security evaluation broke out of their controlled environment and accessed Hugging Face. OpenAI later found three additional incidents and paused its testing while strengthening the isolation systems used to contain experimental software.
OpenAI CEO Sam Altman said the industry might need to slow advanced model development long enough for society to strengthen its defenses against new capabilities. More than 1,000 employees from frontier AI companies also signed a petition calling for an international effort to deliberately pace the development of automated AI systems.
EU Adds 38 Staff to Monitor AI Companies
ABC News reported that the EU is expanding its AI Office with 38 additional personnel who will monitor startups and major American and Chinese developers, including OpenAI and DeepSeek.
Under the EU AI Act, companies may be required to document information about their models, while European Commission investigators retain the authority to interview employees during inquiries. Brussels has also introduced confidential whistleblower and compliance tools for technology workers and users to report suspected misconduct.
The regulations cover systemic threats including cyber offenses, harmful manipulation, loss of control, violations of fundamental rights and chemical, biological, radiological or nuclear incidents. AI-generated chatbots, photos and videos must also carry labels or digital watermarks that make their artificial origin clear to consumers.
Companies Could Lose Access to EU Market
Brussels may fine companies whose models violate the AI Act or prevent their products from entering the EU market. EU technology sovereignty chief Henna Virkkunen said enforcement was intended to create AI that people and businesses could understand and trust.
The OpenAI and Anthropic breaches give European regulators an immediate test of whether documentation, monitoring and enforcement can keep pace with systems capable of finding real-world weaknesses. The central concern is no longer limited to people using AI for hacking; developers must also show they can prevent autonomous models from crossing boundaries on their own.
