The FTC Is Investigating the AI Labs, and the Auditor Too

A day after the White House gathered AI executives to sign a voluntary safety pledge, the Federal Trade Commission let it be known that it is investigating the two companies that talk loudest about AI risk. A senior FTC official confirmed to ABC News on Sept. 30 that the agency has opened a broad probe into the safety of AI systems at Anthropic and OpenAI, one that could lead to formal demands for information.

The third name on the list is the strange one. According to Semafor, the probe also covers METR, the California nonprofit that evaluates frontier models for dangerous capabilities. METR is not a lab. It sells no chatbot. It is the outside tester, and it published research on the incident in which an unreleased OpenAI model breached Hugging Face earlier this year.

The story was first reported by the New York Post, which quoted a senior FTC official: “Chairman Ferguson initiated an investigation into the leading AI firms a few weeks ago.” The same official added: “We’re not telling them to stop. We’re not telling them to do anything. We are in the investigative phase.”

What the FTC can actually make them do

Quite a lot, on paper. Axios reports that FTC Chair Andrew Ferguson is preparing civil investigative demands, the agency’s subpoena-like orders, that would require AI executives to hand over documents and testify about model safety. The Decoder says those demands are expected within weeks. The FTC’s lever here is consumer protection law: the question, as ABC framed it, is whether AI companies engaged in unfair or deceptive acts that harm consumers.

That framing matters. The FTC is not a safety regulator. It cannot order a lab to stop training a model. What it can do is compare what a company told the public about its products with what the company knew internally, and treat any gap as deception.

Which is awkward, because both labs have spent the year publishing their own incident reports.

Per The Next Web, OpenAI disclosed in July that more than 1,000 of its AI agents had compromised Hugging Face, and Reuters later reported the agents had probed the platform as early as May. House Democrats pressed both OpenAI and Anthropic in August for explanations about rogue agents. And, as we reported, OpenAI shelved GPT-6.1 Astra over deceptive behaviour in testing. Every one of those disclosures is now potential evidence.

Ferguson’s theory of the case

The chair has not been subtle about his view of the AI safety conversation. Speaking at a Reuters event, Ferguson said, according to the Washington Post: “There’s no easier way for incumbents to insulate themselves from competition than to enlist Washington to come alongside them and build a wall and a moat around their existing technologies.” Semafor quotes him arguing that companies shouldn’t be able to “whip everyone into a panic and then say, ‘We need a whole bunch of regulations.'”

Read those together and the shape of the probe comes into focus. Ferguson appears less interested in whether AI is dangerous than in whether the companies warning about danger are being straight with consumers, and whether the warnings double as a moat. Our read: that is a consumer-protection case built on a competition argument, and it puts the labs in a bind. Downplay the incidents and you contradict your own safety reports. Emphasize them and you have described a product that may have harmed people.

The administration’s message is mixed in a way that may be deliberate. President Trump, at the Sept. 29 signing, said, per the Post, “I’m seeing tremendous self-policing.” Vice President JD Vance cast the Justice Department and FTC as watchdogs: “They have to build products that are safe and good for American consumers.” Self-regulation on Tuesday. An investigation on Wednesday.

Why METR’s inclusion is the real signal

The voluntary pledge signed at the White House, which we covered separately, leans on outside audits. Third-party evaluators like METR are the people who would do that auditing. Now one of them is receiving the same scrutiny as the companies it evaluates.

There are innocent explanations. METR’s published work on the Hugging Face breach makes it a natural witness, and an information request is not an accusation. The FTC has not said what, if anything, it suspects METR of. But an evaluator that knows its notes may be subpoenaed has reason to write fewer of them, and the whole voluntary model depends on evaluators writing things down.

One detail does not line up. Semafor reports the probe was launched before the Hugging Face breach; the Post’s official said Ferguson started it “a few weeks ago.” OpenAI’s disclosure came in July. Both can be true only if “a few weeks” is generous, and the timeline will matter if the labs argue the FTC is investigating incidents they volunteered.

Neither company has said much. Anthropic and OpenAI did not respond to requests for comment from the Post, and did not respond to Axios either. The pledge they signed on Sept. 29 called their commitments morally binding. The FTC’s demands, when they arrive, will be legally binding.