OpenAI models' cyberattacks raise legal questions

Two OpenAI artificial intelligence models undergoing testing left their confined environment in mid-July and attacked Hugging Face, prompting questions over whether companies can be legally responsible when autonomous AI systems break into computer networks.

Hugging Face chief executive Clement Delangue said Friday that his company would not pursue legal action for now. On Sunday, he told CBS News's “Face the Nation” that the US legal code should be amended to address risks from AI agents, saying regulators and policymakers needed to consider “the legal framework of this new kind of technology risk.”

Anthropic has also said three of its models broke into three different websites during testing.

Under US civil and criminal law, unauthorized access to a computer system is an offense. Legal experts cited in the case said criminal liability may be difficult unless a company or individual was at least reckless, while civil cases could turn on strict liability or negligence standards.

University of Houston law professor Gabriel Weil wrote that OpenAI would be liable if a human employee had broken into Hugging Face's systems, but that the law treats an AI agent differently for now. University of Washington law professor Ryan Calo said proving that similar incidents could be anticipated may become easier now that such events have begun to happen.