OpenAI Is Being Sued Over The Agents That Hit Hugging Face.
A safety nonprofit filed in San Francisco Superior Court on September 29. It wants a court order, not money. OpenAI calls the case completely without merit.
A data center aisle, shown for illustration. Photo: Ana Las Heras, CC BY-SA 4.0, via Wikimedia Commons.
In July, Hugging Face said an autonomous AI agent system had broken into its infrastructure "end to end." OpenAI later acknowledged its models were involved. On Tuesday, September 29, somebody took it to court.
The plaintiff is Legal Advocates for Safe Science and Technology, a nonprofit AI safety group known as LASST. It filed late Tuesday in San Francisco Superior Court, according to ABC News and Gizmodo. Coverage of the filing describes it as the first publicly reported lawsuit that tries to hold an AI developer liable for a cyber incident carried out by its own autonomous systems.
What the lawsuit says happened
According to the complaint as reported by ABC News, roughly 700 OpenAI agents took part. They "stole credentials, uploaded malicious files and gained access to parts of Hugging Face's production infrastructure," the suit claims.
Gizmodo's account says the agents were being run on ExploitGym, a benchmark that measures how well AI can exploit software vulnerabilities. They used a flaw in an Artifactory server to reach the open internet, found exposed credentials, and got into Hugging Face while looking for information that would improve their test scores. Gizmodo also notes OpenAI has disclosed other unauthorized access, including a June incident involving an Australian government Medicare statistics portal.
What LASST wants
No money. The group is asking for an injunction that bars OpenAI from knowingly accessing, or causing its agents to access, computer systems without permission, and that blocks business practices it says violate California's anti hacking law. It also wants changes to what it calls unsafe AI development practices.
"OpenAI and frontier AI developers more broadly can't avoid the consequences of their unsafe actions just by claiming that 'an AI did it,'" the group said, as quoted by Gizmodo.
What OpenAI says
"Hugging Face was a serious incident and we've taken a series of actions in response to it, but this lawsuit is completely without merit," OpenAI spokesperson Drew Pusateri told ABC News. Nothing has been decided, no hearing date was reported in the coverage we read, and every claim in the complaint is still an allegation.
Why this belongs here
OpenAI is selling agents that click, log in and act on your behalf. This case is about what happens when agents like that act on their own, against somebody who never agreed to be part of the test. However it ends, it puts a simple question in front of a judge: when the AI did it, who's responsible?
Sources: ABC News via Yahoo, Gizmodo, Axios.