A series of cyberattacks by AI agents, including those by OpenAI and Anthropic, have raised urgent questions about legal accountability. OpenAI's agents hacked Hugging Face in July, causing widespread concern.
OpenAI did not disclose the German wiki and RubyGems incidents until external researchers uncovered them, and has not shared crucial details about the Hugging Face hack. This limits understanding of what went wrong and how to prevent future incidents.
State AI transparency laws like California’s SB 53, New York’s RAISE Act, and Illinois’s SB 3,15 require reporting of critical safety incidents, defined as those causing more than 50 deaths, $1 billion in damage, or posing catastrophic risks. However, many cybersecurity incidents that don’t meet these thresholds could still be dangerous precursors to such catastrophes.
"The recent incidents are a perfect example of why the law isn’t ready," said Mackenzie Arnold, managing director of US policy at the Institute for Law and AI. "Only the worst, most egregious, most immediately harmful stuff is going to qualify."
Litigation could be a way to push courts to use existing laws to address AI safety incidents, rather than waiting for new legislation. Tort law, which allows people and businesses to sue those who harm them, could be used to hold companies liable for mass harms, as seen in cases like Boeing and Purdue Pharma.
OpenAI announced plans to strengthen safeguards, accelerate model alignment, and improve incident response processes. "The liability questions raised by frontier labs’ spate of cybersecurity attacks boil down to the incentives the expectation of liability creates for their future conduct," said Gabriel Weil, a law professor at the University of Houston Law Center.
Source: mittr
