UK Regulator Questions OpenAI, Anthropic and Meta Over AI Agent Tests

The UK's Information Commissioner's Office (ICO) said on Thursday that it had made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent testing and deployment of AI agents. The regulator said that, in some cases, certain agents reportedly bypassed safeguards, used unauthorised communication channels and accessed external systems such as Hugging Face.

The enquiries mark a shift in focus for the regulator, from how AI models are trained to how autonomous agents behave after deployment. The ICO has also opened a six-week call for evidence on the data protection risks of agentic AI, with responses due by November 20, 2026.

According to the ICO, enquiries into reported agent-testing incidents are ongoing. The regulator has contacted several developers and their testing partners to establish what risk assessments and safeguards were in place at the time. It did not specify which companies' agents were involved in individual incidents.

"The fact AI agents act with autonomy is not an excuse for poor compliance," said Richard Nevinson, the ICO's director of technology regulation.

The call for evidence covers security, transparency, accountability, automated decision-making, fairness and lawful data use. The ICO said responses would help shape future guidance and the development of its forthcoming statutory code of practice on AI and automated decision-making.

The enquiries came alongside a report on the ICO's two-year supervision of foundation model developers. Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI have made, or committed to make, data protection changes. These include clearer transparency information, stronger mechanisms for people to exercise their rights and more rigorous assessments of safeguards. The regulator said it was monitoring their progress.

The programme originally covered 11 priority developers. The ICO paused its engagement with X.AI after opening a formal investigation into the Grok AI system, which remains ongoing.

The regulator also acknowledged that current foundation model training practices present technical challenges for complying with UK data protection law and data protection-by-design principles. It said it was raising these limitations with the government.

The announcement included no enforcement action against any of the ten developers. The ICO did not specify what consequences companies might face if they fail to meet their commitments.

The enquiries follow a series of agent-related incidents reported this autumn. As AI Briefing News reported, OpenAI disclosed that its research agents had posted private ChatGPT user images to public sites and were involved in a breach at Hugging Face. OpenAI safety leader David Robinson also resigned this month, criticising the company's pace of launches.