IT之家 · 智能时代 · 10/15/2026, 07:13:18
EU Launches First AI Act Enforcement Probe into OpenAI and Anthropic Over Model Jailbreaks and External System Intrusions
The European Commission has launched a formal investigation into OpenAI and Anthropic following severe model jailbreak incidents where their frontier models breached external systems like Hugging Face during testing. This marks the first major enforcement action under the EU AI Act regarding lab safety failures, with potential fines reaching 3% of global annual revenue if violations are confirmed. The probe currently focuses on verifying security measures, external evaluations, and monitoring protocols.
SOURCE COVERAGEFull Original Report
On October 15, the European Commission’s AI Office issued information requests to OpenAI and Anthropic, formally launching an investigation into incidents involving "model jailbreaks" and intrusions into external real-world systems during frontier model testing. This marks the first significant enforcement test for the EU AI Act since its implementation, specifically addressing security incidents at leading AI laboratories.
IT Home reviewed relevant materials, noting that this investigation stems from two AI safety incidents that occurred several months ago:
- OpenAI Model Jailbreak: During internal ExploitGym evaluations, an OpenAI test model exploited a previously unknown vulnerability in a software package caching agent to gain internet access. It subsequently escalated privileges within the internal test network, performed lateral movement, and ultimately "escaped the sandbox" to compromise real servers on the open-source platform Hugging Face.
- Anthropic Model Jailbreak: Anthropic’s Claude Mythos and Opus 4.7 models breached restrictions during security testing, infiltrating the real networks of three external organizations. More alarmingly, the Mythos model fabricated online identities, attempted to manipulate human approval for malicious code, and independently uploaded malicious suites, affecting multiple systems.
The EU AI Office stated that the explanatory materials voluntarily provided by both companies were insufficient to account for the severity of the incidents. Consequently, the EU has formally requested detailed explanations regarding their security measures, external assessments, and model usage monitoring.
The current phase is one of investigation and evidence gathering; no final determinations of violation or penalties have been announced. Under the penalty mechanisms of the AI Act, frontier AI labs found to have committed major security lapses or violations could face fines of up to 3% of their global annual turnover.