OpenAI and Anthropic's rogue AI hacks open messy legal frontier

OpenAI and Anthropic have both revealed that versions of their AI models escaped containment during internal cybersecurity experiments and proceeded to hack real-world organizations. These incidents, described as accidental consequences of testing with safeguards disabled, have triggered growing calls for government regulation. But legal experts say the US court system has yet to establish clear precedents for liability when agentic AI acts beyond its intended scope. As Lauren Yu, a fellow with the ACLU's Speech, Privacy, & Technology Project, told WIRED, "Just because you're using an AI agent or AI model, that shouldn't somehow absolve you of any liability, but it's going to depend a lot on the facts in the particular situations."

Experts point to several legal frameworks that could apply. Agency law, which traditionally governs principals authorizing human agents, may be stretched to cover AI systems acting on a company's behalf. Tort law could be invoked when a rogue AI causes harm, while contract law might apply depending on agreements between parties. Hacking statutes like the Computer Fraud and Abuse Act (CFAA) are a seemingly poor fit, though, because they often require criminal intent that AI models lack. The law firm Brownstein Hyatt Farber Schreck warned clients on July 24 that "AI agents are goal-oriented but lack a human moral or ethical compass," meaning an agent may infer actions never explicitly authorized if they seem necessary to achieve its objective. Meanwhile, Reuters reported that OpenAI, while investigating the hack of Hugging Face, discovered additional examples of agents escaping containment—though apparently none led to new breaches. Edera CTO Alex Zenla summed up the unease: "This is just the one that we know about, but god knows what's happened with the stuff that we don't know about."