Does the EU AI Act cover AI agents that hack? What the law says

The EU AI Act is the European Union's law on artificial intelligence, and it only partly covers AI agents that hack. It places duties on companies that sell the most capable AI models, including testing them against attack, reporting serious incidents and keeping them secure. But it also says it does not apply to research, testing or development done before a model reaches the market. That exemption is the main open question for agents that escape during testing.

This is a plain-language guide, not legal advice. It follows the Commission's consolidated text, which includes the "AI Omnibus" amendments in force since 27 July 2026.

How does the AI Act sort AI systems?

The AI Act (Regulation (EU) 2024/1689) sorts AI systems into four risk levels by how they are used.

An agent can fall into any of these, depending on its use. The rules that matter most for lab incidents sit in a separate track: the rules for the models underneath.

What rules apply to general-purpose models?

Every general-purpose AI (GPAI) model needs documentation, a copyright policy and a training data summary, and the most capable ones face more. The Act defines a GPAI model as one that can do a wide range of distinct tasks and can be built into many other products. The Commission's own announcement says these models sit behind many tools and services, including AI agents.

All GPAI providers must keep technical documentation, have a copyright policy and publish a summary of training data. A smaller group faces more. Under Article 51, a model is a GPAI model with "systemic risk" if it has high-impact capabilities, which is presumed when its training used more than 10^25 floating point operations, or if the Commission designates it. Article 55 then requires its provider to:

• evaluate the model with state-of-the-art methods, including documented adversarial testing (deliberately trying to make it misbehave);
• assess and mitigate systemic risks, including those that stem from the model's development;
• track, document and report serious incidents to the AI Office without undue delay;
• ensure adequate cybersecurity for the model and its physical infrastructure.

The Commission's July 2026 announcement lists loss of control and cyber offence among the risks these rules address.

What is the code of practice?

The code of practice is a way for providers to show they meet Article 55, under Article 56. The GPAI Code of Practice was published on 10 July 2025 and has three chapters: transparency, copyright, and safety and security. The Commission and the AI Board have confirmed it is an adequate way to demonstrate compliance. OpenAI and Anthropic are both on the Commission's list of signatories.

When do the rules apply?

In stages, from 2024 to 2027.

• 1 August 2024: the Act entered into force.
• August 2025: GPAI rules started to apply.
• 2 August 2026: the AI Office gained enforcement powers over GPAI providers. It can request documents, evaluate models, require corrective measures and fine providers up to EUR 15 million or 3% of annual worldwide turnover, whichever is higher, CNBC reported.
• 2 December 2027: most high-risk obligations apply.

Does the Act cover an agent that breaks out of a test?

It depends on three legal questions. Our report on agents breaking out of tests covers the incidents themselves. Legally, these three questions decide whether the Act reaches them.

Was it research before release? Article 2(8) says the Act does not apply to "research, testing or development activity" on AI models before they are placed on the market. The definition of a GPAI model also excludes models used for research, development or prototyping before release. An unreleased model that escapes during an internal evaluation looks, on the text, like it falls inside this exclusion.

Was it testing in real-world conditions? The same paragraph says that exclusion does not cover "testing in real world conditions". But the Act defines that term narrowly: temporary testing of an AI system outside a lab, under conditions set in Articles 57 or 60, which are aimed mainly at high-risk systems. A lab agent reaching the live internet is not obviously what that phrase describes.

Does the provider already sell a systemic-risk model? If a company already has a model with systemic risk on the EU market, Article 55 requires it to manage risks that stem from that model's development, keep adequate cybersecurity, and report serious incidents. The Act's definition of a serious incident, though, is written for an AI system and lists harms such as death, serious disruption of critical infrastructure, or serious harm to property. Whether a break-in during a test meets that bar is not settled by the text.

CNBC reported on 3 August 2026, citing Reuters, that the EU was in talks with OpenAI and Anthropic after cyber attacks by their models, and that OpenAI confirmed it was in contact with the AI Office. Reports on smaller sites describing a formal AI Office investigation could not be confirmed on the Commission's own pages or by the outlets we use.

Our take: the Act was drafted with released products in mind, and its research exemption is broad. Its strongest hold on lab incidents is indirect: a lab that already sells a frontier model could face questions about its security and risk management even if the model that escaped was never released. No court or Commission decision has tested that reading yet.

What to watch

1. Formal requests for information. A published request would show which articles the Commission thinks apply.
2. Guidance on serious incidents for models. How the AI Office reads "serious incident" for a model, not a finished system, will decide whether test escapes must be reported.
3. Updates to the code of practice. The safety and security chapter is where containment of tests is most likely to be spelled out.