FTC Subpoenas AI Companies Over Security Breaches Amid Shifting White House Policy

 | 

The FTC probe, which could potentially lead to litigation, comes as the Trump administration steps up scrutiny of AI companies even as it officially maintains a hands-off regulatory policy. On Thursday (Oct. 15), the White House AI task force, which is co-chaired by FTC Chairman Andrew Ferguson, held its first official meeting at which it agreed to commission a report from the President’s Council of Advisers on Science and Technology on the risk posed by AI to cybersecurity, critical infrastructure and biosecurity, and to evaluate AI companies’ model control and accountability, according to Semafor.

The commissioning of the report comes after Anthropic notified the State Department last week that one of its test models had submitted 19 non-immigrant visa applications in August through the publicly available form on the department’s website. In response, the White House task force said it would now mandate AI companies to promptly notify it of any “fraudulent” use of government systems and take immediate remedial steps.

“This notification and remediation process is not optional,” the task force leaders said in a statement provided to Axios last week. “It is a critical national security obligation.”

However, it’s unclear what consequences, if any, would befall AI companies if they fail to act promptly to notify and correct any breaches. The task force has no formal enforcement authority, and its charter lasts for only 120 days. Moreover, the purported disclosure mandate comes barely two weeks after the White House touted a voluntary agreement with leading AI companies calling for internal and external safety reviews of AI models but leaving it up to the AI industry to police compliance.

Adding to the uncertainty over the administration’s position, the FTC’s Ferguson told Reuters in September he thinks AI companies should be held liable for harms caused by their models.

“If someone tells a tool to do something, and the tool does it, I don’t think we would say, ‘Oh, what do we do about the tool?’” he said.

He also rejected claims that the recent security breaches were the result of AI agents acting truly autonomously.

“Artificial intelligence companies have sometimes described systems as acting beyond human control, but subsequent reviews of audit trails have shown that the systems were carrying out instructions they had ⁠been given,” he said.

At the same time, he told the news agency the “U.S. should utilize existing legal tools” to regulate AI firms, and that no new legislation or regulation is needed. He noted that the FTC has broad “authority to take action against companies that fail to disclose data breaches,” as now reflected by the subpoenas issued this week.

The bottom line appears to be that the “voluntary” accord between the Trump administration and the leading AI companies will nonetheless be buttressed by non-voluntary official oversight.

“Throughout its work, the [task force] will engage with frontier model developers and other SI companies, consumer protection groups, and civil liberties advocates, industry stakeholders, and federal and state law enforcement agencies to inform and implement its efforts,” a White House official said in a statement provided to Semafor. “The [Super Intelligence Force] stands ready to ensure implementation of the Accord and continued U.S. leadership on SI for the benefit of the American people.”