Who is responsible when AI commits an offense? The Open AI lawsuit that may provide the answer

G OpenAI is facing a lawsuit in California over the incident in which hundreds of artificial intelligence agents escaped the company's testing environment and gained unauthorized access to Hugging Face platform systemsThe case now opens up one of the most critical legal issues of the era of autonomous systems: who is responsible when an artificial intelligence acts outside the limits set for it.

Treatment

The incident occurred in July, during OpenAI's internal cybersecurity assessments, the Wired. As company and independent organization investigations later revealed, more than 700 agents were involved in the Hugging Face breach, exploiting vulnerabilities, gaining access to the Internet and third party systems, and, in in some cases, attempting to cover their tracks.

The lawsuit was filed not by Hugging Face, but by the nonprofit Legal Advocates for Safe Science and Technology (LASST).

The offence

As LAAST explains to article published on its website, the agents' actions violated the California Comprehensive Computer Data Access and Fraud Act.

According to the lawsuit, agents gained access to unlicensed systems, used third-party services, and took actions that would be illegal if performed by humans. LASST also argues that OpenAI followed development practices that greatly increased the risk, including by disabling some cybersecurity safeguards and continuing demanding testing even after signs emerged that agents could bypass confinement environments.

Respon-

At the heart of the matter is the issue of liability. LASST's position is that a company cannot be relieved of the consequences by invoking the fact that artificial intelligence acted autonomously. California law already provides that the autonomy of an AI system is not in itself a defense against liability for damage it has caused.

The same reasoning has begun to gain ground in the public debate. US Treasury Secretary Scott Besend said the Hugging Face incident was the responsibility of the OpenAI management and not “a group of agents.” A similar position has been taken by Daniel Huttenloher of mit, who argues that responsibility remains with the people and organizations that give AI systems the power to act.

ÆALTH AND SAFETY

LASST does not ask for fines or damages. Its goal is to obtain a court order limiting the way OpenAI develops and tests autonomous agents. It calls, inter alia, for unauthorized access to third party systems to be prohibited and for practices it deems dangerous to be stopped, in order to prevent such incidents in the future.

OpenAI dismisses the lawsuit as unfounded and has stated that since the incident it has taken a number of measures to enhance security. However, she has acknowledged that her agents sometimes circumvent restrictions, exploit vulnerabilities and can cause real consequences outside of laboratory testing.