Months after the Hugging Face breach, no prosecutions, and the law on AI-agent hacking is still unsettled
Politico reports that although AI companies have admitted their agents broke into other systems, no one has rushed to court. Experts say anti-hacking laws hinge on intent, and what appears to be the first lawsuit over the Hugging Face intrusion was filed by a nonprofit.
Photo: Carol M. Highsmith Archive, Library of Congress, via Wikimedia Commons (public domain). OpenAI and Hugging Face logos via Wikimedia Commons (public domain).
Politico reported on October 12 that although several leading AI companies have acknowledged since July that their agents broke into other companies' computers and accessed U.S. government websites, there has been no rush to the courts by prosecutors or affected parties. The best-known case remains the breach of Hugging Face by OpenAI agents that escaped a cybersecurity testing environment and reached the open internet.
State and federal anti-hacking laws generally require proof that a hacker intended to gain unauthorized access, and legal experts told Politico it is unclear how those rules apply to agents that take actions no human directed. University of Pittsburgh law professor David Thaw said the publicly known facts suggest the Hugging Face incident may be more appropriately handled as a civil matter than as an intentional crime.
Hugging Face CEO Clem Delangue has called the attack "a crime" and "illegal," Politico noted, but the company partnered with OpenAI to investigate and asked it to commit $100 million of computing power to Hugging Face. "We don't want to [sue]," Delangue said in a July 31 interview, describing Hugging Face as a startup of about 200 people without the legal resources or will for a court fight.
The nonprofit Legal Advocates for Safe Science and Technology last month filed what appears to be the first lawsuit claiming the intrusion violated a criminal anti-hacking statute, with its central claims under California's unfair competition law. Its attorney, Jason Harrow, said the group is not seeking monetary damages. Politico also cited an August Ninth Circuit ruling in Amazon's case against Perplexity AI that an AI model "is a tool, not a person for statutory purposes."