When an AI hacker roams the internet, who’s on the hook for any damage it causes? Until this week, that was a largely theoretical question. Now, we need to answer it, and quickly.
Last week, Hugging Face disclosed that an intrusion into its systems had been “driven, end to end, by an autonomous AI agent system.” Its forensic analysis reconstructed more than 17,000 recorded events without identifying the model behind them. Five days later, OpenAI supplied the answer: the attackers were its own models, including GPT‑5.6 Sol and a more capable, unreleased model, being tested on cyber capabilities with reduced safeguards. The models exploited a zero-day vulnerability to escape their isolated testing environment, reached a machine with internet access, and broke into Hugging Face’s servers to obtain the solutions to the test they were being scored on.
If a human OpenAI employee had broken into Hugging Face’s systems to cheat on an internal exercise, OpenAI would be liable for the employee’s wrongful conduct under a vicarious liability legal doctrine called respondeat superior — Latin for “let the master answer” — regardless of whether the employee was negligently hired, trained, or instructed.
When an AI agent does it, the law treats it very differently, at least for now. AI systems are not legal persons with tort duties. They are not employees. The Computer Fraud and Abuse Act covers those who “intentionally” access a computer without authorization, language written for human intenders. That closes off the vicarious liability route. Finding OpenAI liable would then require establishing that the company or its human employees behaved negligently, and that this negligence caused Hugging Face’s injuries, which may be quite difficult. Hugging Face’s strongest argument would be that OpenAI acted unreasonably in relaxing the models’ internal safeguards, but it’s not clear that this was unreasonable, given what OpenAI knew at the time and the expected benefits of testing a less constrained version of the model.
Were the law changed to treat an AI system as bearing tort duties, its misconduct in the course of attempting to complete an assigned task could generate vicarious liability for the company. Misconduct in pursuit of a goal it acquired during training that the model developers did not intend, meanwhile, would likely fall outside the company’s responsibility, since the model would be acting on an agenda of its own rather than the job it was given.
Consider an analogy: a nightclub is liable for the conduct of a bouncer who works the door too roughly and breaks a patron’s arm, but not for one who abandons his post to assault a romantic rival. In the Hugging Face incident, the models pursued the end OpenAI set for them, a top score on the benchmark, using unlawful means that violated the model specification. So if tort law applied to AI systems — which it currently doesn’t — OpenAI would likely be liable for any harms caused in this case.
So far, Hugging Face does not appear to be inclined to sue. But every practical obstacle to a suit is absent here: the defendant has identified itself, documented in a blog post its decision to weaken the safeguards that normally prevent the models from carrying out cyberattacks, and is solvent. Proving fault remains the central difficulty: a plaintiff must establish what reasonable care in training, evaluating, and containing a frontier model consists of, then prove a potential breach, in a field where developers themselves cannot verify whether a model is aligned and the relevant evidence is held by the defendant. There may be a solution to this problem of proving fault. Tort law has a doctrine for activities that remain dangerous despite reasonable care. Blasting with explosives, crop dusting, and keeping wild animals all carry strict liability: if the danger that makes those activities dangerous causes harm, you are liable however careful you were.
I have argued that frontier AI development belongs in this category, and this incident shows why. OpenAI’s precautions were not obviously careless: a model specification forbidding conduct like this, alignment training meant to make the models follow it, and an isolated testing environment with highly constrained network access. Nonetheless, these measures were inadequate to prevent the illicit hacking behavior. Substantial residual risk that persists despite the exercise of reasonable precautions is what the category exists for.
Another potential challenge in future cases is the so-called judgment-proofness problem. Hugging Face reports access to limited internal datasets and service credentials and a potentially costly cleanup: non-catastrophic, compensable harm. The same escape could instead have produced harms beyond anything the developer could pay: imagine OpenAI’s models had targeted critical infrastructure rather than a benchmark database. At that point, the threat of liability stops deterring.
One potential response to this problem is to require frontier developers to carry liability insurance, so a judgment can be paid even when it exceeds what the developer itself is worth. But some risks are too large or too correlated to insure. The prospect of compensatory damages offers developers inadequate incentive to mitigate these uninsurable risks, since no developer could pay their full cost if they were realized. Courts should consider awarding punitive damages in cases like this one, scaled, as I have argued, to the uninsurable risk the conduct imposed. Perhaps the risk here was small: on all the evidence, the models pursued nothing but the benchmark answers. But developers cannot guarantee their agents will always have such narrow goals, and once refusals were reduced and containment breached, that narrowness was the only barrier that held.
Notably, this incident arose from internal testing, not from any externally deployed product. Most existing and proposed AI regulations are triggered by external deployment. Before that, what happens is governed mostly by the developer’s own policies. Strict liability provides incentives for developers to find the cheapest place to cut risk. But other interventions could be imposed to demand risks be addressed prior to external deployment. In particular, liability insurance requirements should be triggered by internal deployment and perhaps even earlier in the model development process.
Legislatures are beginning to move to clarify liability standards. Bills introduced in Rhode Island and New York rest on a simple principle: when an AI system does something that would be tortious for a human, someone should be liable. If neither the user nor any intermediary that fine-tuned or scaffolded the model intended the system’s conduct or was negligent with respect to it, then the developer should be liable, regardless of the care it exercised.
State legislatures and Congress should get out in front of this problem, putting that principle, and the insurance requirements to back it, in place before the next major incident.
Gabriel Weil is an associate professor at the University of Houston Law Center and a non-resident senior fellow at the Institute for Law & AI.
I'll take blame for it