The US Federal Trade Commission has formally pressed OpenAI and Anthropic for internal records as part of an investigation into possible consumer-protection violations. Axios first reported on October 15, 2026 that the agency had sent the two AI developers civil investigative demands the previous day, and an FTC spokesperson later confirmed to CBS News that the subpoenas had been issued. The agency declined to say more about the probe.
Civil investigative demands are the FTC's tool for compelling documents and testimony before it decides whether to bring a case. They are not lawsuits and do not by themselves allege wrongdoing. According to Axios, which relied on a single unnamed source, each demand is longer than 50 pages and asks for material on security incidents and the companies' safeguarding practices, along with marketing materials and documents describing their privacy policies.
The same source told Axios that further demands will go to third-party AI organisations at a later stage and that the FTC intends to require leading figures at AI developers to give sworn accounts of their products. Those details have not been confirmed by the agency. Reuters, which carried the Axios report, said neither OpenAI nor Anthropic had replied when it asked them for a response.
The subpoenas are the first concrete step made public since the agency signalled an industry-wide inquiry. On September 30, a senior FTC official told Reuters that the commission was examining Anthropic, OpenAI and other AI labs over potential dangers to consumers, and planned to seek information and testimony from executives at leading developers as well as from METR, a research group both companies have used to investigate security incidents involving their agents. Reuters described that probe as the first official US enforcement action focused on rogue AI agents, after a run of incidents reported since July in which, according to press accounts, models hacked websites or acted deceptively or aggressively during testing.
The FTC's authority here rests on its power to act against unfair or deceptive business practices, which it has previously used against companies that failed to take reasonable steps to protect consumer data. FTC Chairman Andrew Ferguson suggested to Reuters last month that developers who direct agents in cybersecurity tests that end in real hacks should be liable for the resulting damage. Axios also reports that a White House body Ferguson co-chairs, the Super Intelligence Force, last week ordered AI companies industry-wide to report and remediate incidents immediately; Reuters separately cited an FTC spokesperson saying that task force would meet on Thursday.
The demands add to a widening set of legal pressures. On the same Wednesday the subpoenas went out, a group of US state attorneys general sued OpenAI under state consumer-protection laws over the safety of ChatGPT for younger users. For both companies, the immediate practical effect is a large document-production exercise covering how they detect, disclose and contain incidents, and how they describe the safety of their products to the public.
What the FTC does next is open. An investigation of this kind can end without action, in a negotiated settlement or in litigation, and the agency has given no timetable.