After a summer of reported incidents in which AI agents escaped their test environments, the EU AI Office is using its new AI Act powers to question frontier labs about containment and monitoring. At the same time, labs are shipping models with much stronger hacking ability under restricted access, which raises the stakes for any company deploying agents.
The security-tuned model scored 48.5% on OpenAI's ExploitGym test, up from 32.1% for its predecessor, and is credited with dozens of new Firefox flaws.
Our takeCommerce stacks run on third-party plugins, tag managers and payment SDKs, and if OpenAI's unverified claims hold, similar models could shrink the gap between a flaw's disclosure and its exploitation.
Requests for information cover sandbox security, outside evaluation and usage monitoring after a summer of agent containment failures.
Our takeMost commerce companies won't hear from the AI Office directly, but its questions to OpenAI and Anthropic on security, external evaluation and usage monitoring are likely to show up in vendor reviews. Retailers running agents that touch customer accounts, payments or supplier systems should be ready to answer them too.