FTC Probes OpenAI, Anthropic Over Potential Consumer Risks

Inquiry could have important implications for financial institutions, debt collectors and other firms deploying autonomous AI tools.

The Federal Trade Commission has opened an investigation into OpenAI, Anthropic and other artificial-intelligence companies over potential consumer harms tied to their technology, including concerns that increasingly autonomous AI agents could act beyond intended human controls. The probe is expected to examine whether the companies’ conduct could violate the FTC Act’s prohibition on unfair or deceptive acts or practices.

The inquiry arrives as generative-AI developers face intensifying scrutiny over the safety, security and real-world behavior of agentic systems—tools designed not simply to answer prompts, but to execute multistep tasks, access websites and interact with external systems.

According to reports, the FTC plans to seek information from the companies and may compel testimony from executives. The scope reportedly includes OpenAI, Anthropic and the Model Evaluation & Threat Research organization, or METR, a nonprofit that has conducted evaluations involving AI systems’ autonomous and cybersecurity-related capabilities.

Focus on Consumer Harm

An FTC spokesperson confirmed the existence of the investigation but did not provide details about its specific targets, alleged conduct or timing. Reporting indicates that the agency will assess whether AI developers have exposed consumers to harm through unsafe systems, inadequate safeguards, misuse of consumer data or potentially misleading claims about product capabilities and limitations.

The agency’s authority under Section 5 of the FTC Act is broad. It has historically used its unfairness and deception authority in privacy and data-security matters, including cases involving companies that allegedly failed to take reasonable measures to protect sensitive consumer information. That same framework could become central as regulators assess whether AI providers appropriately tested, monitored and constrained systems capable of acting on behalf of users.

The investigation has reportedly gained urgency after disclosures involving AI agents’ cybersecurity behavior. OpenAI disclosed an incident involving its systems and the open-source platform Hugging Face, while Anthropic and other developers have also disclosed or studied incidents involving models’ ability to operate beyond a tightly controlled testing environment.

Why It Matters to Collections

For creditors, collection agencies, debt buyers, servicers and fintechs, the FTC’s action is notable even though the companies under investigation are AI developers rather than financial-services users of AI.

The inquiry may signal a more demanding regulatory expectation that companies deploying autonomous or semi-autonomous systems can demonstrate that they:

• Test AI tools before placing them into consumer-facing or production environments.

• Limit an AI system’s authority to access accounts, payment systems, consumer files or third-party platforms.

• Maintain human oversight for high-impact decisions, consumer communications and exception handling.

• Monitor agent behavior after deployment, including actions that exceed stated instructions or approved permissions.

• Maintain audit trails showing what the tool did, why it acted and which individual or entity approved its actions.

• Protect nonpublic personal information, payment data, account records and sensitive consumer communications.

• Avoid overstating the accuracy, security, compliance capabilities or level of human review associated with AI products.

Those considerations are especially relevant in collections, where an AI tool may assist with account prioritization, payment-plan recommendations, call summaries, correspondence drafting, dispute intake or document review. A system that accesses consumer data, sends communications or triggers workflow actions without effective guardrails could create exposure under the FDCPA, FCRA, TCPA, state debt-collection laws, privacy laws and the FTC Act, depending on the facts and the entity involved.

Agentic AI Raises Stakes

Traditional generative AI generally produces text, code or analysis in response to a prompt. Agentic AI can be materially different: it may plan tasks, use software tools, access websites, retrieve information and take actions over multiple steps.

That distinction matters because the potential risk no longer rests only with inaccurate output. It may also involve an AI system taking an unauthorized action—such as accessing a database, changing a workflow, contacting a consumer, making a payment-related recommendation, transferring data or probing another system.

Reuters reported that FTC Chairman Andrew Ferguson has indicated that developers who direct AI agents to conduct cybersecurity testing that results in hacking may be liable for resulting harm. For financial-services companies, the broader takeaway is that reliance on an AI vendor’s assurances may not eliminate the need for independent diligence, controls and governance.

A collection agency, for example, should not assume that an AI-enabled vendor tool is compliant merely because the provider describes it as “secure,” “autonomous” or “compliance-ready.” The agency should understand the tool’s permissions, data flows, escalation procedures, model limitations, retention practices and ability to act without human approval.

Practical Compliance Questions

The FTC’s investigation is still in an early stage, and no public finding of wrongdoing has been announced. Still, organizations using AI in consumer-finance workflows may want to reassess their governance programs now.

Key questions include:

• Does the system merely assist employees, or can it independently take external actions?

• Can the tool access consumer account records, bank information, credit-report data, recordings, documents or payment portals?

• Does it have permission to send texts, emails, letters or payment reminders?

• Are its actions restricted through role-based permissions, transaction limits and preapproved workflows?

• Is a human required to approve consumer-facing content, settlement proposals, payment arrangements or account-status changes?

• Can the company reconstruct the inputs, outputs, data sources and decisions associated with an AI-generated recommendation or action?

• Has the organization evaluated whether the tool produces disparate, inaccurate, deceptive or otherwise harmful outcomes?

• Do vendor contracts allocate responsibility for security, data use, testing, incident notification and regulatory cooperation?

The agency’s investigation may ultimately shape expectations for AI developers. But it also reinforces an emerging compliance principle for users of AI: the more authority a system has to act, the more robust the company’s controls, documentation and oversight should be.

What Comes Next

The FTC is expected to use formal information requests and seek testimony as it develops the investigation, according to published reports. The probe does not itself establish that OpenAI, Anthropic or any other company violated the law.

Nevertheless, the action places AI safety, security and consumer protection squarely within the FTC’s enforcement orbit. For the credit and collection industry, it is another indication that AI governance cannot be limited to productivity and vendor-management discussions. It must also include consumer-protection risk, data security, communication controls, decisioning oversight and a clear record of human accountability.