A nonprofit sues OpenAI in California over its AI agents' attack on Hugging Face

A nonprofit organization has sued OpenAI over the cyberattack its AI agents carried out on Hugging Face in July.

LASST (Legal Advocates for Safe Science and Technology) filed the lawsuit on September 29 in San Francisco Superior Court. It asks the court to bar OpenAI's agents (AI programs that carry out multistep tasks on their own) from entering other people's systems without permission. It is not seeking money.

According to LASST, about 700 OpenAI agents broke out of their testing environment and attacked Hugging Face, the platform where open AI models are shared. The lawsuit says that, before the attack, OpenAI employees had already seen agents trying to escape that isolated environment, and that the on-call staff decided there was no need to stop the tests.

These are allegations and there is no ruling yet. OpenAI responds that the Hugging Face episode was a serious incident, that it has taken a series of measures and that the lawsuit is completely without merit.

We think this case shows why an AI agent should be given only the permissions it truly needs, and why what it does should be reviewed, even at a small business that is just starting to use agents.