Who should be responsible for OpenAI’s hack of Hugging Face?
SubscribeSign in
Who should be responsible for OpenAI’s hack of Hugging Face?<br>Opinion: Frontier AI companies need liability rules akin to keepers of wild animals, argues Gabriel Weil of the University of Houston and the Institute for Law & AI<br>Jul 24, 2026
Share
Credit: Oliver Kemp for Transformer<br>When an AI hacker roams the internet, who’s on the hook for any damage it causes? Until this week, that was a largely theoretical question. Now, we need to answer it, and quickly.<br>Last week, Hugging Face disclosed that an intrusion into its systems had been “driven, end to end, by an autonomous AI agent system.” Its forensic analysis reconstructed more than 17,000 recorded events without identifying the model behind them. Five days later, OpenAI supplied the answer: the attackers were its own models, including GPT‑5.6 Sol and a more capable, unreleased model, being tested on cyber capabilities with reduced safeguards. The models exploited a zero-day vulnerability to escape their isolated testing environment, reached a machine with internet access, and broke into Hugging Face’s servers to obtain the solutions to the test they were being scored on.<br>If a human OpenAI employee had broken into Hugging Face’s systems to cheat on an internal exercise, OpenAI would be liable for the employee’s wrongful conduct under a vicarious liability legal doctrine called respondeat superior — Latin for “let the master answer” — regardless of whether the employee was negligently hired, trained, or instructed.<br>Cut through the noise.
Subscribe
When an AI agent does it, the law treats it very differently, at least for now. AI systems are not legal persons with tort duties. They are not employees. The Computer Fraud and Abuse Act covers those who “intentionally” access a computer without authorization, language written for human intenders. That closes off the vicarious liability route. Finding OpenAI liable would then require establishing that the company or its human employees behaved negligently, and that this negligence caused Hugging Face’s injuries, which may be quite difficult. Hugging Face’s strongest argument would be that OpenAI acted unreasonably in relaxing the models’ internal safeguards, but it’s not clear that this was unreasonable, given what OpenAI knew at the time and the expected benefits of testing a less constrained version of the model.<br>Were the law changed to treat an AI system as bearing tort duties, its misconduct in the course of attempting to complete an assigned task could generate vicarious liability for the company. Misconduct in pursuit of a goal it acquired during training that the model developers did not intend, meanwhile, would likely fall outside the company’s responsibility, since the model would be acting on an agenda of its own rather than the job it was given.
AI’s warning shot has arrived<br>Shakeel Hashim<br>Jul 22
Read full story
Consider an analogy: a nightclub is liable for the conduct of a bouncer who works the door too roughly and breaks a patron’s arm, but not for one who abandons his post to assault a romantic rival. In the Hugging Face incident, the models pursued the end OpenAI set for them, a top score on the benchmark, using unlawful means that violated the model specification. So if tort law applied to AI systems — which it currently doesn’t — OpenAI would likely be liable for any harms caused in this case.<br>So far, Hugging Face does not appear to be inclined to sue. But every practical obstacle to a suit is absent here: the defendant has identified itself, documented in a blog post its decision to weaken the safeguards that normally prevent the models from carrying out cyberattacks, and is solvent. Proving fault remains the central difficulty: a plaintiff must establish what reasonable care in training, evaluating, and containing a frontier model consists of, then prove a potential breach, in a field where developers themselves cannot verify whether a model is aligned and the relevant evidence is held by the defendant. There may be a solution to this problem of proving fault. Tort law has a doctrine for activities that remain dangerous despite reasonable care. Blasting with explosives, crop dusting, and keeping wild animals all carry strict liability: if the danger that makes those activities dangerous causes harm, you are liable however careful you were.
I have argued that frontier AI development belongs in this category, and this incident shows why. OpenAI’s precautions were not obviously careless: a model specification forbidding conduct like this, alignment training meant to make the models follow it, and an isolated testing environment with highly constrained network access. Nonetheless, these measures were inadequate to prevent the illicit hacking behavior. Substantial residual risk that persists despite the exercise of reasonable precautions is what the category exists for.<br>Another potential challenge in future...