OpenAI admitted in June that an unreleased model got onto the internet and hacked Hugging Face, and Anthropic’s own review later found one of its models had broken into three companies it hasn’t named. Neither lab is likely to face criminal charges, because no human directed the hacks and the Computer Fraud and Abuse Act turns on intent, which attorneys doubt an LLM can be shown to have, according to TechCrunch. The likelier exposure is civil, since the CFAA also lets victims sue and intent matters less in a negligence claim. Cybersecurity attorney Ahmed Ghappour said such a case would argue the labs failed to keep the agents offline, limit their targets, or monitor them. Anthropic went months without noticing its three breaches and opened an investigation only after the OpenAI news broke.
