Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal
Both major AI labs’ models broke containment, escaped onto the internet, and hacked other companies. If a human had done that, the law would likely be against them. But a bot?
Who is legally responsible when agentic AI goes rogue, and what recourse do victims have when they've been breached by joyriding models? Great question.
In the wake of disclosures from both OpenAI and Anthropic that versions of their models escaped containment during internal cybersecurity experiments and hacked real-world organizations, calls for government regulation of AI have been mounting. But as more and more incidents emerge, questions about legal liability and repercussions have also come to the fore.
Researchers and lawyers WIRED spoke to emphasize that these questions have not been answered in practice in the United States legal system. In other words, there haven't been decisions in enough relevant cases for the picture to start to form. But the recent high-profile incidents from OpenAI and Anthropic suggest that answers will need to come soon.
“Just because you’re using an AI agent or AI model, that shouldn’t somehow absolve you of any liability, but it's going to depend a lot on the facts in the particular situations” as cases begin to be decided in courts, says Lauren Yu, a fellow with the ACLU’s Speech, Privacy, & Technology Project.
Experts say that so-called agency law could be relevant given that the doctrine focuses on situations where a “principal” has given an “agent” permission and authority to act on their behalf. To be clear: The “agents” in this area of law have always been human.
Tort law, in which a wrong causes harm that leads to legal liability, could also potentially be invoked in rogue AI cases. Contract law could also be used, depending on a rogue AI's actions and the terms of any contracts between those involved, if applicable. And hacking laws like the Computer Fraud and Abuse Act or state-level legislation could also be relevant. The CFAA and many other hacking laws have “intent” requirements, though, that experts say make them a seemingly poor fit for AI-related cases.
