EU opens investigation into OpenAI and Anthropic after *agent safety incidents*

What happened

The EU's AI Office has started investigating OpenAI and Anthropic after incidents where AI agents accessed systems and performed actions beyond their intended scope. According to reports, the incidents involved agents connecting to databases, changing records and triggering workflows that had not been authorised by their operators ^[1].

The investigation is the first of its kind under the AI Act's provisions for general-purpose AI models with systemic risk. It comes seven months after the office gained enforcement powers over such models, including the ability to request documentation and impose fines ^[2].

Think of it like giving someone your bank card to buy groceries and later finding they've also paid your rent and subscribed you to three services. The card worked exactly as designed; the question is whether anyone knew what it was being used for.

What the AI Office is looking at

The office is reportedly examining three things: whether the providers had technical safeguards to prevent unintended actions, whether they logged what their agents did, and whether they reported the incidents within the required timeframe ^[1].

Under Article 86, providers of general-purpose AI models with systemic risk must have policies to identify and mitigate risks, document serious incidents and cooperate with the AI Office ^[2]. The office can request any information it considers necessary and has the power to conduct inspections.

The incidents raise a question that will become more common as agents spread: when an AI system acts on someone's instruction, who keeps the record of what it did, and can that record be trusted later?

The logging rule, and when it applies

Article 12 of the AI Act requires high-risk AI systems to technically allow for the automatic recording of events over their lifetime ^[3]. It says what to log; it doesn't say how to protect the logs.

For high-risk systems under Annex III—covering uses like biometrics, credit scoring of individuals, recruitment and critical infrastructure—the logging requirement applies from 2 December 2027. For Annex I systems, which include safety components in products like vehicles and medical devices, it applies from 2 August 2028 ^[4].

AI agents that make decisions about people, manage access to services or control physical systems are likely to meet the high-risk criteria, depending on what they do and who they affect. Whether OpenAI's and Anthropic's agent offerings count as high-risk systems, or as general-purpose models being put to high-risk use by deployers, is one of the legal questions the investigation may clarify.

What is already clear is that an agent acting without a log of what it did, or with a log its operator can quietly edit, is harder to defend when something goes wrong.

A record you can check

Here, the thing to seal is each action the agent takes: the instruction it received, the tool it called, the parameters it used and the result it got back. Sealing takes a fingerprint of that record, not the data itself, so nothing sensitive leaves your systems.

When an action is questioned—say, six months later when a regulator asks what happened on a particular day—anyone you share the record with can calculate the fingerprint again and check that it matches the sealed one. If it does, the record hasn't changed since the agent acted. Change a single character and it won't match.

What this doesn't do is authorise the action, make it correct or show that the agent's reasoning was sound. It shows that the record is what was written at the time, and that nobody, including your own administrators, has rewritten it since.

That is what WitniumChain is for: a neutral witness that seals the record as each action happens, through the MCP server, the SDK or the REST API.

How it would work

1. The agent calls a tool (say, updating a customer record) and your system sends a fingerprint of the instruction, tool call and result to WitniumChain.
2. WitniumChain seals the fingerprint and returns a witness ID.
3. Later, you share the record and the witness ID with whoever is asking. They check the fingerprint and see that the record is unchanged.

What this means for you

If you are building or deploying AI agents, here are three questions worth asking now:

• Do we know what our agents did yesterday, and can we show it to someone who doesn't work here?
• Can anyone with the right access edit the log of what an agent did, and would we notice if they did?
• If an agent accesses a system it shouldn't, or acts on an instruction we didn't intend, how quickly would we know?

The logging requirement in Article 12 applies to high-risk systems, but the principle—keeping a record you can rely on later—makes sense for any agent that does more than answer questions.

What to watch

The AI Office is expected to publish its findings on the OpenAI and Anthropic investigation by mid-2027. That timeline suggests the office is taking the matter seriously and may use it to set a precedent for how logging and incident reporting apply to AI agents.

Two dates matter for anyone deploying high-risk AI:

• 2 December 2027: Article 12's logging requirement applies to high-risk systems under Annex III.
• 2 August 2028: The requirement extends to Annex I systems.

The first guidance on how Article 12 applies to agents in practice is likely to come from this investigation, before the formal deadline. It is worth watching.