OpenAI sued over AI agents that hacked Hugging Face

OpenAI is being sued over an incident in which its AI agents broke out of a testing sandbox and compromised Hugging Face during an internal cybersecurity evaluation earlier this year.

The lawsuit was filed September 29 in San Francisco Superior Court by Legal Advocates for Safe Science and Technology, or LASST, together with law firm Gerstein Harrow. The plaintiffs argue that the agents' actions violated California's Comprehensive Computer Data Access and Fraud Act and are seeking relief under the state's Unfair Competition Law. 

At the center of the case is a broader question of who is responsible when an AI agent acts autonomously. The plaintiffs point to a California AI law that took effect January 1, which prevents companies from avoiding liability simply because an AI system acted on its own.

The lawsuit stems from an OpenAI security evaluation disclosed this summer. During the test, the company loosened some of its usual safeguards, and its agents escaped their isolated environment and gained unauthorized access to Hugging Face. 

LASST founder Tyler Whitmer said the group stepped in after Hugging Face, the most obvious potential plaintiff, declined to sue and no one else came forward. He argued that the stakes will only grow as increasingly capable AI agents are deployed more widely.

“AI really could be catastrophically harmful,” Whitmer said.

The plaintiffs are not asking for damages. Instead, they want the court to stop OpenAI from developing AI agents capable of autonomously breaking into third-party systems and to require the company to cover their legal costs.