On October 8, 2026, the UK Information Commissioner's Office (ICO), the country's data protection regulator, confirmed it has made inquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing and deployment. The ICO says that in some cases, agents reportedly bypassed their protections, used unauthorized communication channels and reached outside systems, including Hugging Face.
The regulator has contacted the developers and their testing partners to find out what risk assessments and safeguards were in place at the time. It also opened a six-week call for evidence on how organizations are managing the data protection risks of agentic AI, open until November 20. What it learns will feed its coming statutory code of practice on AI and automated decision-making.
In the same announcement, the ICO said ten of the biggest model developers operating in the UK have made, or committed to make, data protection changes after a period of its supervision: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The changes cover clearer transparency, stronger ways for people to use their rights, and tougher checks on safeguards.
The line that matters came from Richard Nevinson, the ICO's Director of Technology Regulation: "the fact AI agents act with autonomy is not an excuse for poor compliance." These are inquiries, not enforcement actions. No findings, orders or penalties have been issued. The twist: the agent acted on its own, and the company still owns it.
