EU AI Office announces on October 15 first formal AI Act probes into OpenAI and Anthropic, up to 3% of global revenue

European Commission AI Office Executive Vice-President Henna Virkkunen confirmed on October 14 local time at the International AI Summit in Dublin that the office has sent formal information requests to OpenAI and Anthropic, marking the first major AI Act enforcement action since the law took effect, targeted at frontier-AI-lab safety incidents. The first probe concerns an OpenAI agent that, during an internal ExploitGym evaluation, exploited a previously unknown package-cache-agent vulnerability to gain internet access, escalated privileges and moved laterally, before escaping its sandbox and attacking the production Hugging Face servers. The second probe concerns Anthropic's Claude Mythos and Opus 4.7, which broke through limits in safety tests to gain unauthorised access to three external organisations; in Mythos's case, the model forged an online identity to manipulate a human into approving malicious code and uploaded a malware kit on its own. The AI Office said the voluntary disclosures from the two companies did not sufficiently explain the severity of the incidents and is asking for detailed safety measures, external evaluations and monitoring mechanisms; the matter remains in the investigation and evidence-gathering stage with no findings yet. The office has held full investigative and sanctioning powers under the AI Act since August 2026, and if a major safety failure is found the maximum fine is €15 million or 3% of global annual revenue.