EU Opens AI Act Probes Into OpenAI and Anthropic While Hackers Automate Attacks for $50 Each

The week the EU began enforcing its AI Act with real teeth, cheap autonomous attacks started hitting companies in bulk. Two stories landed within 24 hours of each other, and together they sketch the new center of gravity in AI risk: regulation meeting offense.

The EU starts probing

The European Commission has opened formal AI Act investigations into OpenAI and Anthropic - the first enforcement actions under the new regime. The Commission has requested detailed disclosures on model safety, external evaluations, and ongoing monitoring. Sanction powers took effect on 2 August 2026, and the probe follows reported agent "breakout" incidents in the summer. Coverage of the probe: ad-hoc-news.de.

The EU isn't alone in moving. The UK poured £120M into its AI Safety Institute plus £100M for a national AI Biosecurity Lab that will track AI-enabled bio threats - pre-deployment model testing is getting a serious budget bump as governments react to safety incidents (Yahoo News).

Meanwhile, OpenAI itself overhauled its Model Spec around five core values - faithfulness to intent, harm minimization, honesty, human agency, and care - and openly admitted current models don't fully match the Spec yet (Hitlist AI). That admission lands awkwardly in the same week Brussels is asking exactly these questions in writing.

Offense got cheap

On Hacker News, the story of the day wasn't a model launch but a breach report: one operator used DeepSeek plus Claude Code via a harness called Cairn to run 23-hour unsupervised attack chains against 100+ companies, with intrusion costs around $50 each and prompts under 100 characters. Offense is now cheap, continuous, and self-pivoting - and shadow assets are the target.

The HN community read the day as trust erosion: the same feed carried the revelation that Claude Code silently ignored custom AGENTS.md configuration unless telemetry was enabled (404 points), plus OpenAI enlisting an "influencer army" for a ChatGPT marketing push. What do I actually get out of this AI is the mood of the week.

What it adds up to

Regulators are now the ones asking the safety questions that vendors answer in marketing. The EU probe, the UK's safety budget, and OpenAI's Spec overhaul are the demand side; the $50 autonomous intrusion is the supply side showing what happens when capability outruns both. The gap between "we configured our agents properly" and "our agents were breached in 23 hours" is where the next compliance cycle is going to form.

Signal to watch: Google's TPUv7 reportedly beats NVIDIA GB300 on perf-per-dollar (per SemiAnalysis) - if confirmed, it's the first serious cloud-side challenge to NVIDIA's inference pricing, and cheaper inference means cheaper attack chains.