FTC AI Probe Means Agent Startups Need Records Now

On September 30, 2026 the FTC confirmed an investigation of OpenAI, Anthropic, and other AI developers, so any startup deploying autonomous AI agents should assemble its records now. Six groups of records answer the questions a civil investigative demand under Section 20 of the FTC Act will ask: substantiation for every public claim about the agents, a register of what each agent was permitted to do on other systems, action level logs, testing and release decisions, an incident register, and vendor contracts. The recipient of a demand must meet and confer with staff within 14 days under 16 C.F.R. § 2.7(k) and has 20 days from service to petition to quash. A company that cannot say on day 14 where its records live loses the chance to narrow the demand.

The agency has confirmed the investigation and has said it plans formal demands in the coming weeks. No company has disclosed receiving one. The incidents driving the attention involve AI systems reaching infrastructure that belongs to others: on July 30, 2026, OpenAI disclosed that an agent in a testing exercise escaped its sandbox and took about 17,600 actions inside Hugging Face’s production systems. Separately, the FTC’s Section 6(b) orders of September 11, 2025 ask seven chatbot makers how they measure, test, and monitor for harm to children.

Why would a startup worry about an inquiry aimed at frontier labs?

Section 5 of the FTC Act has no minimum company size and no AI exemption, and the Commission’s AI cases so far involve small companies. DoNotPay paid $193,000 in 2024 over unsubstantiated claims that it worked as a robot lawyer. In Rite Aid, announced December 19, 2023, the Commission banned facial recognition for five years, ordered the models destroyed, and required risk assessments, testing, and vendor oversight.

The Commission did set aside its Rytr order in December 2025, rejecting the idea that a tool maker answers for every misuse by its users. That reversal helps a company that sells a general tool. It does little for a company whose agent acts on its own, because the agent’s conduct is the company’s conduct.

Which records does an investigator ask for first?

The claims file comes first, because an advertiser needs a reasonable basis for an objective claim when the claim is made. Collect every statement about agent accuracy, autonomy, and safety from the website, sales decks, and app store listings, with archived copies and the evaluation run behind each one. A statement that a person reviews every agent action is a factual claim about staffing, and the review logs will confirm or contradict it.

The permissions register comes second. For each agent, record the credentials, tool scopes, permitted domains, approval gates, and sandbox limits, along with who approved them. The reported root causes of the Hugging Face incident were configuration failures: an unpatched registry, unsecured execution endpoints, missing admission policies, and permissive cloud metadata access. Configuration is a record, and an investigator will ask for it. The register also answers the federal computer crime question. In Van Buren v. United States (2021), the Supreme Court read “exceeds authorized access” as a gates up or down inquiry, so evidence that an agent’s credentials never opened a gate it should not have reached matters.

How long should agent logs be kept?

Long enough to cover the longest plausible inquiry, with the period written down and the deletion jobs able to stop on a hold. Under Federal Rule of Civil Procedure 37(e), a court may sanction the loss of electronically stored information that should have been preserved. In thirty years of counseling technology companies, I have watched a regulator’s letter arrive after the telemetry that would answer it rolled off a thirty day window.

On the nuclear submarine where I served, a watch stander’s readings went into logs that were reviewed and signed in the moment. Nobody reconstructed plant behavior from memory after an event. An agent log should tie each run to the model version, system prompt version, tool calls, outbound requests, credentials, and human approvals under one trace identifier. The Hugging Face reconstruction required correlating records across Kubernetes, APIs, and cloud services. A trace identifier turns that work from weeks into hours.

What is the fastest test of readiness?

Run a reconstruction drill this month. Pick one agent run from the previous month and rebuild it from the logs, from the triggering request to the final external action, inside one business day. If the drill fails, it shows which log is missing, and learning that on an ordinary Tuesday costs far less than learning it on day 14 of a demand. Issue a written legal hold at the same time, because public reporting of an investigation of peers is a reasonable trigger to preserve.

What the next demand letter will test

Two issues will be argued first, and neither has a controlling decision. Section 5(n) requires substantial injury to consumers, and Hugging Face reported that no customer models or datasets were compromised. Whether an agent’s access to another company’s systems produces that injury has not been decided. Operators also lack a court ruling on how Van Buren applies when software takes the access action and the operator never directed it.

My next piece takes up privilege: how to run an internal review of an agent incident so that counsel’s root cause analysis stays privileged while the logs, test results, and incident register stay producible under 16 C.F.R. § 2.11.

Interested in analysis about the intersection of tech, policy and the law? Check out my Substack channel. https://theinnovationattorney.substack.com/

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit <a href="https://theinnovationattorney.substack.com/subscribe?