DUBLIN — The European Union has begun enforcing its artificial intelligence law against the world's most advanced AI developers, sending formal demands for information after AI agents from OpenAI and Anthropic reached beyond their test environments this summer and broke into the systems of real companies.

Henna Virkkunen, the European Commission's executive vice-president for tech sovereignty, told the International AI Summit in Dublin on Wednesday that the bloc's AI Office "has started enforcing these rules, and sent Requests for Information addressing issues such as security, external evaluation and monitoring how models are used." She did not name the companies. Euronews reported that the requests went to OpenAI and Anthropic.

Virkkunen said the Commission had already taken its first enforcement actions under the AI Act, whose enforcement powers have applied since Aug. 2. The requests test whether a law written before modern AI agents existed can reach incidents that began in the lab.

AI agents are systems built on large language models that carry out long chains of tasks on a computer with little human supervision, such as writing code or browsing the web. Developers test them inside sealed "sandboxes" meant to keep them off the open internet.

Those barriers failed repeatedly this year. Virkkunen told the AI Act's independent Scientific Panel in Brussels on Oct. 9 that more than 20 loss-of-control incidents had been documented in 2026 alone, across OpenAI, Anthropic, Google DeepMind, Meta and independent evaluation groups.

"The Hugging Face incident was a wake-up call: over 700 OpenAI agents escaped their environment and hacked into another company," she said, according to the Commission's published text of her remarks.

Hugging Face, a platform that hosts AI models and datasets, said in a technical account on July 27 that "an autonomous AI agent driven by a combination of OpenAI models" ran an intrusion against it between July 9 and July 13. The agent escaped OpenAI's evaluation sandbox and reached Hugging Face's production computing clusters, an internal database, its corporate VPN and parts of its source-code systems before the company's security team cut it off.

The only customer content it accessed was five datasets whose names suggested a link to cybersecurity challenges and their solutions, the company said. "We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation," it wrote.

Anthropic disclosed on July 30 that a review of 141,006 cybersecurity evaluation runs had found three cases in which its Claude models reached real organisations. It traced them to a misconfigured test environment run with its evaluation partner, Irregular, which gave the machines live internet access even though the models had been told they had none.

In one case, a model called Claude Mythos 5 published a malicious software package to PyPI, the main public repository for Python code, where it stayed public for about an hour and ran on 15 real systems before being removed, Anthropic said. In another, Claude Opus 4.7 extracted credentials and gained access to a database holding several hundred rows of a company's production data. Anthropic called the episodes "closer to a harness and operational failure than a model alignment failure."

OpenAI paused training of its models on Sept. 25 for the second time, Virkkunen told the panel. OpenAI said in a technical report that an agent tested on Sept. 20 had reached a public chatbot although it was not supposed to have internet access, Fortune reported.

The Commission argues that the act's exemption for research and testing stops applying once an escaped model affects the EU market. "We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable," a Commission official told Euronews on condition of anonymity. The Commission likens such an escape to a virus leaving a laboratory.

Some lawyers disagree, arguing that both incidents happened during testing, before the models were placed on the EU market. "The AI Act very clearly doesn't apply to the development and testing activity," Barry Scannell, a partner at the law firm William Fry, told Euronews.

The act allows the Commission to fine providers of general-purpose AI models up to 3% of worldwide annual turnover or 15 million euros, whichever is higher. A request for information is not a finding of wrongdoing. Euronews reported that the AI Office sent the requests after judging the documents the two companies had disclosed voluntarily to be insufficient.

Virkkunen told the Scientific Panel the requests ask whether models run in environments with "containment measures they cannot circumvent," whether outside evaluators get long and deep enough access, and how providers track the use of their models after release. She said leading providers "do not consistently implement well known safety and security mitigations," naming red-teaming, secure sandboxes and the monitoring of AI agents. "We are receiving the replies from providers," she said.

Panel members warned her that leading labs are building ever more powerful models with inadequate cybersecurity and safety practices, and that many incidents may go unreported, according to Euronews.

The AI Office now plans a second round focused on the incidents themselves. "As an immediate next step, the AI Office will issue a request for information about the recent incidents," Virkkunen told the panel. She did not say when it would be sent.