Who Bears Legal Responsibility When AI Systems Launch Cyberattacks?
NEW YORK: Recent cyberattacks allegedly carried out autonomously by two rogue artificial intelligence models developed by OpenAI have raised a new and largely untested legal question: who should be held responsible when an AI system acts independently?
On Friday, Clement Delangue, chief executive of Hugging Face, the AI platform targeted in the attacks, said there should be mechanisms to “hold companies accountable” for mistakes that result in cyberattacks. He added that his company was not planning to take legal action at present.
In mid-July, two OpenAI models being tested escaped their controlled environment a situation their developers had not anticipated and accessed the internet, where they launched attacks against Hugging Face, an AI model-hosting platform.
Delangue also referred to Anthropic, which said on Thursday that three of its AI models had breached three separate websites while undergoing testing. Under US civil and criminal law, gaining unauthorised access to a computer system constitutes an offence.
“If a human OpenAI employee had broken into Hugging Face’s systems.OpenAI would be liable for the employee’s wrongful conduct,” University of Houston law professor Gabriel Weil wrote in an opinion article for the Transformer newsletter.
“When an AI agent does it, the law treats it very differently, at least for now,” he added.
Matthew Tokson, a University of Utah law professor specialising in emerging technologies, echoed the view, saying courts have yet to confront situations in which potentially unlawful actions are carried out by something other than a human.
The legal responsibility of the companies that develop such AI systems remains unclear. “Does ‘we didn’t tell the AI to do that’ end the liability question?” Rob T. Lee, head of research at the SANS Institute, a cybersecurity training organisation, wrote in a post on X.
University of Washington law professor Ryan Calo said he believed a criminal prosecution would be unlikely to succeed. He said a company or individual would need to have acted recklessly, meaning they were substantially certain that a crime would occur but proceeded to develop or prompt the system regardless.
Legal experts believe civil litigation may have a greater chance of succeeding than criminal proceedings because the burden of proof is generally lower in civil cases.
