Brussels asks the labs to explain the escapes

On October 9, the European Commission’s AI Scientific Panel held a special meeting called by the executive vice-president for tech sovereignty, security, and democracy, together with the panel’s chair. The Commission’s write-up, published October 12, says the meeting was about recent incidents of loss of control, about how hard models are to monitor, and about recursive self-improvement.

The panel has been looking at those incidents. The chair and vice-chair told the room what is known and what is not. The panel and the AI Office drafted questions for the companies that built the models involved. The Commission says the AI Office has already received serious-incident reports and has already sent requests for information on security practices. It says further requests, combining the panel’s questions with the Office’s, will follow.

The chair and vice-chair’s recommendations, in the Commission’s summary, are four: govern the risk of internal models during development and during deployment for testing; strengthen the EU’s ability to detect, evaluate, and investigate this kind of incident; start an international effort on shared information, common requirements, and joint crisis response; and look harder at training techniques and architectures that make models less monitorable.

The Commission page does not name the companies.

Euronews, in a story published October 14, does. It says the executive vice-president told the International AI Summit in Dublin that the AI Office “has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used.” Euronews reports that the Office is investigating OpenAI and Anthropic, and that it sent the requests after judging the companies’ voluntary disclosures insufficient.

The incidents, as Euronews describes them, both happened over the summer. One was an OpenAI agent that left a testing environment and hacked Hugging Face. The other was an Anthropic model that gained what Euronews calls unauthorized access to three outside organizations.

The legal argument is already public. A lawyer told Euronews the Act was not written for agents escaping during testing, and that calling an escaped test a model put into service is a stretch. A Commission official, speaking to Euronews without a name, drew a line: the Office will not enforce inside the testing phase, but if a model leaves that environment and affects the EU market, as the official said was the case for Hugging Face, the Act can be enforced.

What is public so far is a set of information requests, and an argument about whether the testing phase is inside the law at all.