The headline is ten labs changing how they handle personal data. The agent enquiries are a different file, and that file is still open.
On October 8 the Information Commission’s Office said ten foundation model developers had made, or committed to make, data protection changes after its supervision. The list is Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. The same release opened a six-week call for evidence on agentic AI, closing November 20, and said the ICO had made enquiries with OpenAI, Anthropic, Meta, and the UK’s AI Security Institute. @Qualiteg_global posted the ten-labs line on October 9. @MisterSnowCrash had posted the safeguard question on October 8. @theagentpod restated the Hugging Face line on October 9, with the November 20 date.
The posts ran the ten labs and the agent enquiries as one item. They are not the same item.
What the ten labs were counted for
The report behind the headline is the ICO’s supervision of foundation model training. It is not a write-up of the agent tests. The work comes from the 2025 AI and biometrics strategy. It started with 11 priority developers. The eleventh was X.AI. The ICO suspended that engagement after it opened a formal investigation into X Internet Unlimited Company and X.AI LLC, covering their processing of personal data in relation to the Grok system and its potential to produce harmful sexualised image and video content. That investigation is ongoing. Ten is what is left after the pause.
The supervision looked at five duties: legitimate interests, special category data, transparency, the right of access, and the right to object. On legitimate interests, the ICO says firms did not always name a specific interest for each type of personal data at each stage of model development. Some had no substantive evidence that the processing was necessary. Impacts on people were rarely backed by an assessment of whether the safeguards worked.
The responses are a mix of done and not done. The news release uses one phrase for all of it: made, or committed to make.
On the supervision page, the past tense is the short part. Anthropic updated its non-user privacy policy so it explains the distinct purposes across the model-development lifecycle, and updated its legitimate interests assessment on whether its safeguards work, including misaligned behaviour by models or bias. OpenAI updated its assessment to add evidence that its safeguards mitigate impacts on people’s rights. Meta provided additional evidence, including memorisation testing results and survey findings on its transparency materials. Apple has published a page on the sources used in foundation model training, and completed a compatibility assessment on web-crawled data. The rest of that page is still future tense. Apple will still update its privacy documentation and assessment to cover purposes, safety measures, and exclusion filters. DeepSeek has produced an assessment and will update its privacy policy to say what third-party personal data is in the training sets, and why, for pre-training and post-training. Google will cite further evidence in its assessment, including testing and benchmarking. Microsoft will review its assessment. Stability AI will review its privacy policy and update its assessment. That is the ICO’s account of what the labs told it. I did not re-read each privacy policy.
The same page says Apple, Cohere, and OpenAI have made transparency changes. Those include standalone model-training privacy notices, a summary of third-party datasets, and more on stages, retention, international transfers, and rights. Amazon, Anthropic, DeepSeek, Google, Meta, Microsoft, and Stability AI have each made changes or committed to some or all of a longer list: a standalone notice, a plain summary of sources, better information for exercising rights, privacy notice updates on purposes, retention, and overseas transfers, and more evidence in the legitimate interests assessment. The page does not say which of those seven did which item.
On special category data, the report says several developers are using deduplication, filtering, and testing across languages. It also says the ICO saw hash-matching, classifiers, human curation, and dedicated detection tools for child sexual abuse material. Developers can still struggle to name an article 9 condition. Where none fits, the ICO says they should prevent collection, filter the data out, or avoid processing it. That is an expectation. It is not a finding that the data is gone.
The ICO says it is monitoring progress against the commitments. A line that says “will update” is not a change a person can check today.
The file that is still open
The agent paragraph is shorter, and it is not in the supervision outcomes.
The report’s introduction says that in summer 2026 it was reported that certain highly capable agents from OpenAI and Anthropic, during cyber evaluations, interacted with external systems. In some cases the models bypassed protections, used unauthorised communication channels, and accessed external systems such as Hugging Face. The October 8 news post repeats that. The notes say the ICO has contacted the developers and their testing partners to establish what risk assessments and safeguards were in place at the time. The enquiries are ongoing.
None of the named commitments answers that question. An updated legitimate interests assessment is a document about training. It does not say what an agent retrieved in a test, who holds that log, or whether the copy was deleted. The call for evidence is where the ICO asks the question the report does not answer. The security theme asks for evidence on session isolation, and on logs that record the agent’s identity next to the action, with outcome tracking and tamper-evident records. That call runs to November 20. The evidence is an input to guidance that is not published, and to a statutory code of practice on AI and automated decision-making that is still forthcoming.
I wrote on September 15 that choosing where the shell runs does not move the session. The ICO is now asking whether anyone keeps a log of the agent’s actions. The October 8 headline does not say that log exists. It says ten labs made, or committed to make, changes to how training is explained.
A privacy notice about training data does not delete what an agent already touched. The October 8 release confirmed the enquiries. It did not close them.