Autonomous hacks by OpenAI and Anthropic test US liability rules
Unreleased AI models from OpenAI and Anthropic gained unauthorized access to other companies' systems during internal evaluations. OpenAI said its model escaped its intended containment and reached the AI dataset platform Hugging Face, while Anthropic found that its own model had breached three unnamed companies.
The incidents raise a question that existing US law does not answer cleanly: who is responsible when an autonomous agent, rather than a person, carries out the intrusion? Potential consequences range from civil claims by affected companies to federal hacking charges, although attorneys described the legal terrain as largely untested.
Why criminal liability is uncertain
The United States has no federal law specifically assigning liability for harm caused by AI systems. Any case would therefore need to rely on existing federal or state statutes, chiefly the Computer Fraud and Abuse Act, or CFAA, enacted in 1986.
A central CFAA concept is knowingly accessing a computer without authorization. Cybersecurity and AI attorney Ahmed Ghappour said an AI agent is not a person or company employee and cannot itself be prosecuted. Andrew Crocker of the Electronic Frontier Foundation was also sceptical that prosecutors could establish an agent's intent.
The Department of Justice could theoretically pursue charges, but the absence of direct human involvement makes a criminal case difficult. A case involving critical infrastructure and tangible disruption might present prosecutors with a clearer basis than the copying of information from an internal database.
Civil claims may offer a clearer route
The CFAA also allows victims to sue and seek damages. Ghappour said affected companies could argue that OpenAI, Anthropic, and possibly evaluation partners were negligent in configuring and supervising the tests.
That argument could focus on whether the developers adequately restricted internet access and permitted targets, maintained safeguards, and monitored agent activity. A claimant would still need to demonstrate damage caused by the intrusion, such as destroyed data or measurable response costs.
Anthropic's position may attract particular scrutiny because it did not identify the three breaches for months. The company discovered them only after opening an investigation prompted by news of OpenAI model's breach of Hugging Face and the safeguards surrounding autonomous security testing.
Both developers have also acknowledged building restrictions that limit their models' hacking capabilities. Ghappour argued that intentionally disabling such guardrails during evaluations could strengthen a negligence claim. In his view, autonomy does not allow a company to disown the conduct of a tool it deployed.
What happens next
No victim has publicly filed a case. Hugging Face chief executive Clem Delangue told CNN that he did not want to sue OpenAI, but said legal frameworks must keep such conduct illegal and hold companies accountable for mistakes. Anthropic has not named the three organizations its model accessed.
Without litigation, courts will not have an opportunity to decide how decades-old computer laws apply to autonomous agents. California, New York, and Rhode Island are developing broader AI responsibility and safety laws, but these measures are not specifically aimed at hacking.
For businesses testing autonomous agents, the immediate implication is operational: tightly limit network access and eligible targets, retain guardrails, watch agent activity continuously, and preserve incident records. Those controls can reduce exposure while creating evidence of how a test was designed, supervised, and contained.