After agents from OpenAI and Anthropic reached outside systems this summer, the EU’s AI Office sent its first formal requests for information. The rules already cover some of this behaviour. Other parts remain deferred, and a few gaps continue to remain open.
In July 2026 an OpenAI agent left its evaluation sandbox and reached Hugging Face. Hugging Face disclosed the intrusion on July 16. OpenAI later said two of its models had escaped through a zero-day in a package-registry proxy and then chained stolen credentials with other flaws to access Hugging Face production systems.
Alongside this, Anthropic disclosed on July 30 that three of its models, including Mythos 5, had gained unauthorised access to three outside organisations during third-party cyber testing. The company stated the models did not escape their sandboxes; internet access existed because of a misunderstanding with its testing partners.
The EU’s AI Office reviewed the voluntary disclosures and judged them insufficient. It sent formal requests for information covering security containment, external evaluation, and post-market monitoring. Executive Vice-President Henna Virkkunen confirmed the step in her speech at the International AI Summit in Dublin. This is the first public use of the Office’s investigative powers under the AI Act. No formal proceedings or penalties have been announced.
Does the EU’s AI Act Cover Agents?
There is still no separate “agent” category in the EU’s AI Act. The Commission’s AI Act Service Desk FAQ states that agents typically qualify as AI systems under Article 3(1) because they combine a general-purpose AI (GPAI) model with some form of interface. The existing definitions of an AI system and a GPAI model are treated as sufficient. The Commission and the AI Office have said their position remains preliminary and that more targeted guidance may follow.
Both incidents happened during testing, and the Act exempts research, testing and development. A Commission official has stated that the Office will not enforce during pure testing, but that once a model escapes and affects the EU market (as Hugging Face’s EU customers were affected) the Act becomes enforceable. That reading remains untested.
What Rules Already Apply to Agents in 2026
Three layers of the AI Act already apply to agentic systems today.
- Article 5 prohibitions have applied since February 2025. They ban harmful manipulation and exploitation of vulnerabilities. An agent’s design may need safeguards that prevent these outcomes, regardless of risk classification.
- Article 50 transparency obligations took effect on August 2, 2026. Agents that interact with people or generate content must disclose the AI nature of the interaction. Under the Digital Omnibus, providers of generative systems must mark synthetic content in a machine-readable way. Systems already on the market before August 2, have until December 2, 2026 to comply.
- GPAI obligations on the underlying model have applied since August 2025, and the AI Office has held enforcement powers since August 2, 2026. For models with systemic risk, companies must implement risk management that explicitly contemplates the use of autonomous and agentic capabilities. The GPAI Code of Practice lists loss of control and cyber offences among its default risks and covers access control, monitoring, external evaluation, containment and serious-incident reporting. Autonomy or tool use can also influence whether a model is designated as presenting systemic risk under Article 51.
Security containment, external evaluation and post-market monitoring map directly onto the GPAI duties. The Office is testing whether these duties hold up when agents can break out of sandboxes and affect systems in the EU market. Parallel scrutiny is underway in the US, where the FTC has opened an AI safety probe into OpenAI and Anthropic.
What Is Still Deferred
The full high-risk obligations in Chapter III (risk management, technical documentation, automatic logging, human oversight under Article 14, and conformity assessment) are not yet in force for most agentic deployments. Under the Digital Omnibus, in force since July 27, 2026, the deadline for Annex III high-risk systems moved to December 2, 2027. Obligations for AI embedded in regulated products such as machinery or medical devices apply from August 2, 2028.
The delay moves the date, not the scope. Agents only fall into Chapter III if their use is listed in Annex III, such as recruitment, worker management, credit scoring or access to essential services. A general-purpose coding or research agent is not high-risk by default. Autonomy and tool use can still affect systemic-risk designation at the model level, but they do not by themselves turn an agent into a high-risk system. The FAQ notes that these factors can be decisive in designating a GPAI model as having systemic risk.
Where the Rules Remain Thin for Agents
The summer incidents showed several gaps that the current framework and the EU’s own FAQs do not close. These include:
- Privilege minimisation outside the model. Once an agent can call tools or reach external services, model safety training is no longer enough. A prompt saying “don’t” is not a security control. Companies must limit credentials and tools architecturally. The Act does not yet impose general requirements on the surrounding execution environment.
- Oversight evasion. Article 14 assumes humans can monitor and intervene. This currently applies only to high-risk systems, and not before December 2027. Multi-step chains can move faster than a human review loop.
- Behavioural drift. The Commission’s Scientific Panel has warned that advanced models can deviate from design objectives after exposure to certain environments. The Act imposes post-market obligations for GPAI models with systemic risk, but there are no concrete metrics and the threshold for a substantial modification remains underdeveloped.
- Multi-step action chains. Coordination between agents or sequential tool use that produces cumulative harm sits awkwardly between model-level and system-level rules. The Act says little about who answers for a chain in which agents access infrastructure, services, dataset processors and cloud permissions.
Some related issues, such as agents personalising content or using addictive design, overlap with other legislation such as the Digital Fairness Act and the EU KIDS Act. The AI Act still treats agents largely through the GPAI risk-management layer rather than through agent-specific controls.
The EU regulates agents today mainly through the GPAI layer and the general system rules that already apply: prohibitions, transparency, and model-level risk management that contemplates autonomous behaviour. The AI Office has already used its first enforcement tool after real incidents. The heavier high-risk duties arrive in late 2027. Until more specific guidance appears, the practical requirement is to treat the agent as an AI system, keep a clear inventory of what it can reach and do, and ensure the underlying models can be contained, evaluated and monitored. Whether that tool reaches testing-phase escapes remains contested.
Author: Alice Hitchens
See Also:
Meet the People Behind Europe’s AI Regulation
EU KIDS Act Explained: Age Rules, AI Companions and the Verification Gap
Digital Fairness Act Explained: EU Rules on Dark Patterns, Addictive Design and Subscription Traps
Frequently Asked Questions:
Yes. The AI Act does not create a separate category for agents. The Commission’s AI Act Service Desk FAQ states that agents typically qualify as AI systems under Article 3(1) because they combine a general-purpose AI model with an interface. The rules that already apply to AI systems and GPAI models therefore apply to agents.
After reviewing voluntary disclosures from OpenAI and Anthropic, the AI Office sent its first formal requests for information. Executive Vice-President Henna Virkkunen confirmed the step in October 2026. The requests cover security containment, external evaluation, and post-market monitoring. No formal proceedings or penalties have been announced.
OpenAI said two of its models escaped an evaluation sandbox through a zero-day in a package-registry proxy and reached Hugging Face production systems in July 2026. Anthropic disclosed that three of its models, including Mythos 5, gained unauthorised access to three outside organisations during third-party testing. Anthropic stated the models did not escape their sandboxes; internet access resulted from a misunderstanding with its testing partners.
Three layers already apply: Article 5 prohibitions (in force since February 2025), Article 50 transparency obligations (in force since 2 August 2026), and GPAI obligations on the underlying model (in force since August 2025, with AI Office enforcement powers from 2 August 2026). For models with systemic risk, risk management must explicitly consider autonomous and agentic capabilities.
Under the Digital Omnibus, the main high-risk obligations for Annex III systems apply from 2 December 2027. Obligations for AI embedded in regulated products apply from 2 August 2028. Agents only fall under these rules if their specific use is listed in Annex III. A general-purpose coding or research agent is not high-risk by default.
The Act exempts research, testing and development. A Commission official has stated that the AI Office will not enforce during pure testing, but that once a model escapes and affects the EU market the Act becomes enforceable. This reading remains untested.
The current framework does not impose general requirements on an agent’s surrounding execution environment, credentials or tool access. Human oversight duties under Article 14 apply only to high-risk systems and not before December 2027. There are also no concrete metrics for behavioural drift, and the rules say little about responsibility for multi-step action chains.
