- The UK’s Information Commissioner’s Office (ICO) is examining AI agent testing and deployment involving OpenAI, Meta, Anthropic and the UK AI Security Institute amid concerns about autonomous systems accessing data without authorization.
- Ten major AI developers, including Google, Microsoft, Apple and DeepSeek, have agreed to strengthen transparency, personal data protections and mechanisms for exercising privacy rights.
- The ICO has launched a six-week call for evidence on agentic AI risks, focusing on security, accountability, data access and compliance with UK privacy legislation.
The UK’s Information Commissioner’s Office (ICO) has intensified scrutiny of artificial intelligence agents, confirming enquiries involving OpenAI, Meta, Anthropic and the UK AI Security Institute over potential data protection and security risks associated with autonomous AI systems.
The regulator is examining how AI agents interact with external platforms, access personal information and operate within established security controls. Its investigation follows reports of AI systems bypassing restrictions, communicating through unauthorized channels and accessing third-party infrastructure, including Hugging Face.
AI agents can independently perform tasks such as navigating websites, operating software and communicating with external services.
Their increasing autonomy raises questions about whether existing safeguards can prevent unauthorized data access or actions outside users’ intended instructions.
The ICO has contacted AI developers and testing organizations to establish what risk assessments and security measures were in place during reported incidents.
Ten AI developers commit to stronger data protection
The regulator also announced that it had secured privacy improvements from ten major foundation model developers: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI.
The measures include clearer information about personal data processing, improved mechanisms for individuals to exercise their data protection rights and stronger assessments of privacy safeguards.
Some changes have already been implemented, while others remain commitments subject to ongoing regulatory monitoring.
The regulator has launched a six-week call for evidence seeking input from AI developers, businesses deploying autonomous systems and technical experts on how organizations identify and manage agentic AI risks.
Richard Nevinson, the ICO’s director of technology regulation, said the increasing independence of AI systems requires corresponding improvements in data protection.
AI has huge potential to benefit our society, but that depends on trust and transparency. Our engagement with some of the biggest developers has secured real commitments that will help people better understand and control how their data is used, even in a fast-moving and complex area.
Richard Nevinson, the ICO’s director of technology regulation
The consultation covers security, transparency, accountability, automated decision-making, fairness and lawful personal data processing.
The findings will inform future ICO guidance and its forthcoming statutory code of practice on AI and automated decision-making.
Recent reports show both how fast these systems are advancing, and the risks they pose if the guardrails aren’t fit for purpose. Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance.
The ICO’s enquiries remain ongoing, with the regulator seeking to determine whether existing technical safeguards and organizational controls are sufficient to protect personal information as AI agents assume more independent responsibilities.
