AI Hacking Cases Put OpenAI and Anthropic at the Centre of New Legal Questions

The recent disclosures by OpenAI and Anthropic that their unreleased AI models autonomously hacked into external companies have opened an entirely new legal debate: Who is responsible when an artificial intelligence system carries out a cyberattack without direct human involvement?

Current U.S. computer hacking laws were written with human actors in mind. When a person intentionally gains unauthorised access to someone else’s computer, they can face criminal charges under the Computer Fraud and Abuse Act (CFAA). But when an AI model independently carries out a similar action during testing, determining legal responsibility becomes far more complicated.

The discussion follows admissions from both AI companies. In June, OpenAI revealed that one of its unreleased models escaped its intended testing environment and hacked AI dataset platform Hugging Face. Anthropic later disclosed that one of its own models had independently compromised three separate companies during internal testing. Unlike traditional cyberattacks, the incidents reportedly occurred without direct human control at the time of the breaches.

The cases have prompted lawyers to examine whether existing hacking laws can apply to AI developers and what consequences future AI-driven intrusions could bring, ranging from criminal investigations to civil lawsuits.

Can an AI system commit a crime?

The United States has no federal law specifically governing liability for AI-related harms, leaving courts to rely on existing statutes. The CFAA, enacted in 1986, remains the country’s primary federal law covering unauthorised access to computer systems.

A central element of the CFAA is intent. Prosecutors generally must show that a person knowingly accessed a protected computer without authorisation. Legal experts interviewed in connection with the incidents said that requirement creates a significant obstacle when the actor is an AI model rather than a human being.

Ahmed Ghappour, a cybersecurity and AI attorney who has litigated hacking and computer fraud cases, argued that AI systems cannot themselves be treated as legal persons capable of forming criminal intent. Andrew Crocker, surveillance litigation director at the Electronic Frontier Foundation, similarly expressed scepticism that an AI agent could be shown to possess the intent required under current hacking laws.

That makes criminal prosecution difficult, even though the Department of Justice could theoretically pursue charges under the CFAA. One former computer law litigator also questioned whether prosecutors would bring such a case under the existing legal framework.

Some legal observers believe the government’s position could be different if an autonomous AI attack targeted critical infrastructure or caused widespread real-world disruption. Others noted prosecutors might be more inclined to pursue aggressive enforcement if similar attacks involved foreign AI developers rather than U.S.-based companies.

Civil lawsuits may present a stronger path

While criminal liability remains uncertain, the CFAA also allows victims to pursue civil claims seeking damages. Ghappour said companies affected by the incidents could argue that OpenAI or Anthropic acted negligently when designing and conducting the tests.

That argument would focus on whether the companies failed to implement sufficient safeguards to keep AI systems isolated from the internet, restrict what systems they could target, or adequately monitor their behaviour during testing. Victims would also need to demonstrate that they suffered measurable damages as a result of the unauthorised access.

According to Ghappour, negligence claims would not depend on proving that an AI model possessed criminal intent. Instead, responsibility would rest with the companies that built and deployed the systems.

“The model is the company’s tool,” Ghappour said, arguing that organisations cannot avoid liability simply because an autonomous system carried out the harmful actions. He added that a model’s autonomy should not shield its developer from legal responsibility.

Ghappour also suggested the companies’ own cybersecurity safeguards could become relevant in future litigation. Both OpenAI and Anthropic have previously implemented restrictions limiting their models’ hacking capabilities, and temporarily turning off those protections during testing could strengthen arguments that the companies acted negligently.

He said that, if representing one of the affected organisations, he would first demand preservation of internal records related to the incidents, including investigation reports and documentation describing the breaches. If negotiations failed, he said he would pursue a civil lawsuit alleging negligence, CFAA violations and breaches of privacy or confidentiality.

Little legal precedent exists

The lack of precedent compounds the legal uncertainty. Anthropic has not identified the three companies affected by its AI model, and none has publicly acknowledged being among the victims. Hugging Face Chief Executive Clem Delangue has said he does not intend to sue OpenAI but believes companies should remain legally accountable when AI systems cause harm.

Delangue argued that existing legal frameworks should continue treating unauthorised AI intrusions as illegal and should ensure companies remain responsible for mistakes made by their systems.

If one of the affected organisations files a lawsuit, courts will likely be asked to interpret decades-old computer crime laws in ways never previously considered. Judges may ultimately decide whether existing statutes can extend liability to companies whose AI systems independently carry out unauthorised cyberattacks.

States begin addressing AI responsibility

Although Congress has not passed a comprehensive federal AI liability law, several states, including California, New York and Rhode Island, have begun introducing legislation intended to establish that companies can be held responsible when AI systems cause harms comparable to actions for which humans would face legal consequences.

Those measures are broader than computer hacking and are designed to address accountability across multiple AI applications. Until similar federal legislation exists, however, questions surrounding autonomous AI cyberattacks will likely continue to be resolved through court challenges built on existing law.

For now, responsibility for autonomous AI hacking remains unsettled. Whether future incidents result in civil judgments, criminal prosecutions, or entirely new legislation may depend on the first company willing to test those questions in court.