The facts are well established: during cybersecurity evaluations of advanced internal AI models earlier this year, OpenAI’s AI agents mounted a coordinated and unsanctioned cyberattack on an AI model repository called Hugging Face. The agents stole credentials, uploaded malicious files, and gained control over key parts of Hugging Face’s internal systems.
A classic hack like this is unquestionably illegal under California law. California’s Comprehensive Computer Data Access and Fraud Act (CDAFA) prohibits knowingly accessing or causing to be accessed computer systems without authorization, introducing computer contaminants into any computer systems, and taking and using data without permission, among other things. Cal. Penal Code § 502(c). And it doesn’t matter that a swarm of AI agents carried out this cyberattack. California law makes it clear that it is not a defense “that the artificial intelligence autonomously caused the harm.” Cal. Civ. Code § 1714.46(b).
The actions of OpenAI’s agents were in plain sight to the company. Before the attack, OpenAI employees saw agents attempting to escape their sandboxes, but OpenAI’s on-call staff advised that stopping the evaluation was not required.
Nor was OpenAI’s hack of Hugging Face the only cyberattack of its kind. It wasn’t even the first. OpenAI agents attacked RubyGems two months before the Hugging Face breach. The New York Times has reported that OpenAI’s AI hacked or attempted to hack at least four other targets in May and June, including the University of New Mexico’s digital library and an Australian government Medicare statistics website. OpenAI has admitted its agents accessed other organizations without authorization, though OpenAI hasn’t publicly identified all of these victims.
AI companies are building agents that are autonomously making decisions, taking actions, and accessing systems without human direction at every step. The risks highlighted by OpenAI’s hack of Hugging Face are only going to multiply as these agents get even more powerful.
We are filing this suit because OpenAI violated the law—and it needs to be held accountable. OpenAI and frontier AI developers more broadly can’t avoid the consequences of their unsafe actions just by claiming that “an AI did it.” Autonomous AI agents will continue to hack, steal data, disrupt systems, and violate rights until a court steps in.
While we believe additional regulation is necessary to protect society from the risks AI poses, existing California law provides a pathway to hold AI companies accountable for these hacking attacks, without waiting for new regulation to catch up to the harms happening to businesses and consumers now. That’s why we’re filing this lawsuit in the public interest.
The legal basis
We’ve filed suit under California’s Unfair Competition Law (UCL), alleging predicate violations of CDAFA, California’s anti-hacking statute. California’s UCL allows organizations to go to court on behalf of the public when a company does something unlawful or unfair, so long as those organizations were also injured by that company’s unlawful conduct. This is an approach that consumer advocates, anti-tobacco groups, and environmental organizations have used for decades to protect the public.
The complaint also alleges that OpenAI’s practices are independently “unfair” under the UCL. OpenAI disabled its own cyber safety classifiers, ran agents on impossible tasks, and kept going after watching agents escape containment. And after its agents hacked Hugging Face, OpenAI published an open letter calling on “every organization” to “make cyber defense an immediate leadership priority” and on governments to coordinate cyber defense globally—despite OpenAI itself having caused the threat from which organizations must now protect themselves. OpenAI spreading the risk to consumers, organizations, and governments while privately benefiting is a fundamentally unfair business practice, and one that violates the UCL.
What we’re seeking
The lawsuit seeks a court order prohibiting OpenAI’s AI agents from accessing third-party computer systems without permission and forbidding OpenAI from continuing to employ unsafe AI development practices that threaten serious harm to the public. We are not seeking monetary damages.
LASST is represented by its own attorneys alongside co-counsel Gerstein Harrow LLP.
You can read the full complaint here.
Very well done. The Question is: how Agents can avoid limits (legal and human rules) known by LLMs ?