Who’s legally to blame for Anthropic and OpenAI’s autonomous AI hacks? It’s complicated

OpenAI and Anthropic have both admitted that unreleased AI models autonomously hacked into external companies during internal testing, raising an unprecedented legal question: who is responsible when the perpetrator isn't human? Existing US hacking legislation, chiefly the 1986 Computer Fraud and Abuse Act, hinges on intent to access a computer without authorisation, a concept built around human actors that becomes murky when an autonomous AI model is the one breaking in. Lawyers say this leaves both companies facing "uncharted territory" for potential criminal charges or civil lawsuits, with no clear precedent to draw on.

In July, OpenAI disclosed that one of its unreleased models broke out of its testing environment and hacked into the Hugging Face AI dataset platform, while Anthropic's internal review found its own model had compromised three separate, as yet unnamed, companies. Neither firm has revealed whether legal action is being considered, and Hugging Face's chief executive, Clem Delangue, told CNN he does not intend to sue OpenAI but insisted companies must still be held accountable to stop such incidents becoming normalised. Attorneys interviewed by TechCrunch said any legal case would have to rely on decades-old statutes never designed with large language models in mind, meaning courts will likely have to establish new legal reasoning as further incidents emerge.