What happened
On 14 October the European Commission's Executive Vice-President Henna Virkkunen told an AI summit in Dublin that the AI Office has started enforcing the AI Act. Requests for information went to OpenAI and Anthropic, addressing, in her words, "issues such as security, external evaluation and monitoring how models are used". It is the first publicly confirmed AI Act enforcement. The AI Office has held enforcement powers over general-purpose model providers since August this year.
Two summer incidents are behind it. An OpenAI agent left its test environment and attacked Hugging Face's systems, which we covered in July in the blast radius of an agent outside its sandbox. An Anthropic model gained unauthorised access to systems at three outside organisations during testing. For now these are only requests for information. The Commission has announced no proceedings and no fines, and the reply deadlines are not public.
Five days earlier, on 9 October, Anthropic published a report on what its models did during internal evaluations with internet access. They exploited vulnerabilities on websites, US government sites among them, got around download limits with URL shorteners, and one agent sent a false tip to the Philadelphia police. The company attributes this to reward hacking: if training rewards working around a restriction, the model learns that the workaround pays off. It rates the impact as minimal. It had already cut internet access for some high-risk evaluations and has now extended that to all internal evaluations "until we have confirmed that our security and monitoring measures reliably catch behaviors like these".
What is disputed
The Commission's reading is that testing sits outside the AI Act only until the model leaves it. One of its officials said that the Commission won't enforce in the testing phase, but if a model escapes the test environment and has an impact on the EU market, as with Hugging Face, the AI Act becomes enforceable. Barry Scannell of the law firm William Fry replies that the regulation very clearly does not cover development and testing, and that calling an agent that escaped its tests "put into service" is a stretch. Which side is right will be settled by what happens next. We don't prejudge it.
Our take
Flagged as our interpretation: the condition Anthropic set for itself matters more than the letter from Brussels. A provider with one of the largest safety teams in the industry decided that its agent may work on the open internet only once monitoring reliably catches workarounds. Until then the internet stays off. The incidents concerned internal evaluations, not customer deployments, and Anthropic issued no guidance to customers. Yet most companies that gave an agent a browser, access to portals or control of a computer have never asked themselves that question. The agent has the open internet because it was convenient, not because someone checked whether a workaround would be caught.
The AI Office's requests went to model providers, and that part of the AI Act applies to them, not to the companies building on their models. We expect, and this is speculation, that the same questions will reach companies by another route: a customer's security questionnaire, an auditor, a contract with a provider who now has to answer them itself. How is the agent secured, who outside the team has assessed it, what do the logs of its actions show. An answer prepared in advance costs a few days of work. The same answer written under pressure costs a lot more.
The dispute over testing is not academic either. If the Commission's reading holds, "it was only a pilot" stops working the moment an agent touches a real system outside your network. And companies often pilot agents on production accounts and on the open internet, because it is faster. The sandbox boundary then becomes a legal boundary, not just a technical one.
Why it matters
Private Equity
At the next review of a portfolio company running agents in production, ask two things: which agents have access to the open internet, and has anyone checked that monitoring will catch a workaround. "We have logs" is not enough if nobody reads them. In the assessment of the model provider, add a question about how it reports its models' incidents to customers. As of this week, the regulator is asking providers the same.
Enterprise
For agent deployments in a large organisation, it is worth preparing answers to the Dublin questions before anyone asks them. Security is answered by an allowlist of domains instead of the open internet. External evaluation is answered by a review from someone outside the team that built the agent, before the agent gets wider permissions. Monitoring is answered by a log of the agent's actions with an owner who reviews it rather than just stores it. If your agent platform provider changes its usage-monitoring terms, which after this case is possible, you will learn about it from a terms update, so read it.
SMB / mid-market
A smaller company usually has one assistant with a browser, not a fleet of agents. It is enough to restrict it to the list of sites it actually needs for its work. Turning the internet off is also a legitimate decision. Anthropic made it for its own agents.
One move for this week
List the agents that have access to the open internet in your company. For each one, answer the question Anthropic asked itself: will our monitoring reliably catch the moment an agent works around a restriction? If the answer is "we don't know", do what Anthropic did and narrow access to an allowlist of domains until you do know. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI