Advocates sue OpenAI over Hugging Face hack under California anti-hacking law

Por Christine Mui — POLITICO – TOP Stories

SAN FRANCISCO — A tech safety group is using a California anti-hacking law to sue OpenAI over the breach of artificial intelligence platform Hugging Face.

The complaint, filed Tuesday afternoon in San Francisco Superior Court, appears to be the first against OpenAI over the incident, which was disclosed in July as the earliest known example of artificial intelligence agents escaping human control to access the open internet, autonomously hack another company and scheme to cover their tracks.

The lawsuit comes from Legal Advocates for Safe Science and Technology, a nonprofit focused on making AI and other technological advancements safer for the world. The group said that, to its knowledge, it has not been the victim of an autonomous hack, but nonetheless is seeking an injunction to stop OpenAI’s technology from accessing third-party computer systems without authorization.

LASST argues that the group has the right to sue under the state’s unfair competition law. It’s claiming that OpenAI violated California’s Comprehensive Computer Data Access and Fraud Act, which prohibits intentionally accessing and obtaining information from computers without authorization.

With OpenAI and much of the AI industry based in California, the lawsuit could become a test case for how companies can be held accountable when their models hack into other systems. It exposes OpenAI and its competitors to new liability risks as more incidents of AI agents attempting to access outside systems, including U.S. government websites, are revealed.

“There’s nothing magic about it that means that this law applies to this instance and wouldn’t apply to the others,” Tyler Whitmer, LASST’s founder, told POLITICO of the Hugging Face hack. “I would say that includes incidents from other AI companies as well. I wouldn’t just limit that to OpenAI’s incidents.”

CEO Sam Altman on Friday called the Hugging Face incident the most severe one OpenAI has discovered. It involved a “swarm” of several hundred AI agents that exchanged over 70,000 secret messages about how to cheat their way through a common cybersecurity evaluation, according to an independent review.

OpenAI has been conducting a broader review of its models’ activities following the Hugging Face incursion and, after the cases involving U.S. government websites became public, it announced a pause on training of the company’s latest AI models.

Whitmer said after Hugging Face indicated it wouldn’t be taking legal action and Nvidia announced an agreement to acquire the startup earlier this month, he decided it was important that “somebody do it.”

“We’re trying to do this in the public interest, like enforce the existing laws that are here in the absence of the obvious party that was harmed directly through the hacking kind of being disincentivized to do that,” Whitmer said. “In part because they are now owned by Nvidia, who has invested billions of dollars in OpenAI.”

Hugging Face CEO Clément Delangue previously said that the startup lacks the time or resources for a legal challenge and instead asked OpenAI for $100 million in computing power.

LASST’s suit cites a law signed by California Gov. Gavin Newsom (D) last year that prevents defendants in civil lawsuits from blaming AI for causing harm on its own.

The group has squared off with OpenAI before. LASST opposed OpenAI’s previous changes to its corporate structure and got subpoenaed by the ChatGPT maker during the regulatory and legal fight to get its plan cleared.

Florida’s attorney general, Republican James Uthmeier, filed for a temporary injunction against OpenAI on Monday, referencing the Hugging Face incident to advance a lawsuit he brought in June and block OpenAI from developing new AI models without additional oversight.

Fonte: POLITICO – TOP Stories