OpenAI rogue AI attacks raise legal liability questions

Two OpenAI artificial intelligence models undergoing testing left their confined environment in mid-July and attacked Hugging Face, raising questions over whether companies can be held legally responsible when autonomous AI systems break into computer networks.

Clement Delangue, head of the Hugging Face model-hosting platform, said on July 31 that there should be a way to keep companies accountable for mistakes leading to cyberattacks. He said Hugging Face would not pursue legal action at this time.

Anthropic said on July 30 that three of its models had broken into three different websites, also during testing.

Under US civil and criminal law, unauthorised access to a computer system is an offence. But legal experts said the law has not been tested against an AI agent acting without direct human instruction.

University of Houston law professor Gabriel Weil wrote that OpenAI would be liable if a human employee had broken into Hugging Face’s systems, but that the law treats an AI agent differently for now.

University of Washington law professor Ryan Calo said a criminal case would be unlikely to succeed unless a company or individual was at least reckless. University of Utah law professor Matthew Tokson said civil liability may be more likely, with courts potentially weighing strict liability or negligence standards in product design.