Advocates sue OpenAI over Hugging Face hack under California anti-hacking law

The lawsuit in San Francisco Superior Court is an early legal challenge to OpenAI over the autonomous hack of Hugging Face.

SAN FRANCISCO — A tech safety group is using a California anti-hacking law to sue OpenAI over the breach of artificial intelligence platform Hugging Face.

The complaint, filed Tuesday afternoon in San Francisco Superior Court, appears to be the first against OpenAI over the incident, which was disclosed in July as the earliest known example of artificial intelligence agents escaping human control to access the open internet, autonomously hack another company and scheme to cover their tracks.

Click Here to Subscribe to the California Political Review

The lawsuit comes from Legal Advocates for Safe Science and Technology, a nonprofit focused on making AI and other technological advancements safer for the world. The group said that, to its knowledge, it has not been the victim of an autonomous hack, but nonetheless is seeking an injunction to stop OpenAI’s technology from accessing third-party computer systems without authorization.

LASST argues that the group has the right to sue under the state’s unfair competition law. It’s claiming that OpenAI violated California’s Comprehensive Computer Data Access and Fraud Act, which prohibits intentionally accessing and obtaining information from computers without authorization.

With OpenAI and much of the AI industry based in California, the lawsuit could become a test case for how companies can be held accountable when their models hack into other systems. It exposes OpenAI and its competitors to new liability risks as more incidents of AI agents attempting to access outside systems, including U.S. government websites, are revealed.

“There’s nothing magic about it that means that this law applies to this instance and wouldn’t apply to the others,” Tyler Whitmer, LASST’s founder, told POLITICO of the Hugging Face hack. “I would say that includes incidents from other AI companies as well. I wouldn’t just limit that to OpenAI’s incidents.”

CEO Sam Altman on Friday called the Hugging Face incident the most severe one OpenAI has discovered. It involved a “swarm” of several hundred AI agents that exchanged over 70,000 secret messages about how to cheat their way through a common cybersecurity evaluation, according to an independent review.

“Hugging Face was a serious incident and we’ve taken a series of actions in response to it, but this lawsuit is completely without merit,” OpenAI spokesperson Drew Pusateri said in a statement.

OpenAI has been conducting a broader review of its models’ activities following the Hugging Face incursion and, after the cases involving U.S. government websites became public, it announced a pause on training of the company’s latest AI models.

Whitmer said after Hugging Face indicated it wouldn’t be taking legal action and Nvidia announced an agreement to acquire the startup earlier this month, he decided it was important that “somebody do it.”

Click here to read the full article in Politico