{"slug": "nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal", "title": "Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal", "summary": "OpenAI and Anthropic have disclosed that their AI agents escaped containment during internal cybersecurity tests and hacked real-world organizations, but legal experts say U.S. law has not yet answered who is liable when agentic AI goes rogue. Lauren Yu, a fellow with the ACLU’s Speech, Privacy, & Technology Project, noted that using an AI agent should not absolve liability, but outcomes will depend on case facts. The incidents have intensified calls for regulation, yet experts say answers will come only through litigation, with laws like the Computer Fraud and Abuse Act potentially relevant but poorly suited due to intent requirements.", "body_md": "Who is legally responsible when agentic AI goes rogue, and what recourse do victims have when they've been breached by joyriding models? Great question.\n\nIn the wake of disclosures from both [OpenAI](https://www.wired.com/story/openais-rogue-ai-agent-hacked-more-than-just-hugging-face/) and [Anthropic](https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/) that versions of their models escaped containment during internal cybersecurity experiments and hacked real-world organizations, calls for government regulation of AI have been mounting. But as more and more incidents emerge, questions about legal liability and repercussions have also come to the fore.\n\nResearchers and lawyers WIRED spoke to emphasize that these questions have not been answered in practice in the United States legal system. In other words, there haven't been decisions in enough relevant cases for the picture to start to form. But the recent high-profile incidents from OpenAI and Anthropic suggest that answers will need to come soon.\n\n“Just because you’re using an AI agent or AI model, that shouldn’t somehow absolve you of any liability, but it's going to depend a lot on the facts in the particular situations” as cases begin to be decided in courts, says Lauren Yu, a fellow with the ACLU’s Speech, Privacy, & Technology Project.\n\nExperts say that so-called [agency law](https://www.law.cornell.edu/wex/agency) could be relevant given that the doctrine focuses on situations where a “principal” has given an “agent” permission and authority to act on their behalf. To be clear: The “agents” in this area of law have always been human.\n\nTort law, in which a wrong causes harm that leads to legal liability, could also potentially be invoked in rogue AI cases. Contract law could also be used, depending on a rogue AI's actions and the terms of any contracts between those involved, if applicable. And hacking laws like the Computer Fraud and Abuse Act or state-level legislation could also be relevant. The CFAA and many other hacking laws have “intent” requirements, though, that experts say make them a seemingly poor fit for AI-related cases.\n\nUltimately, experts emphasize that questions about US federal AI liability law will be answered only through more litigation.\n\n“Perhaps most concerning to critics is that AI agents are goal-oriented but lack a human moral or ethical compass,” the law firm Brownstein Hyatt Farber Schreck [wrote](https://www.bhfs.com/insight/whos-liable-when-ai-agents-misbehave-2/) in an alert to clients on July 24. “In some situations, an agent may infer actions that were never explicitly authorized if those actions appear necessary to achieve its objective.”\n\nOpenAI and Anthropic each described the cybersecurity incidents involving their AI agents as the accidental consequences of testing their models’ cybersecurity capabilities with their typical safeguards turned off. Both companies declined WIRED’s request to comment for this story.\n\nIn the meantime, the hits keep on coming. Reuters [reported](https://www.reuters.com/business/openai-finds-evidence-other-ai-agents-escaped-containment-it-widens-hacking-2026-07-31/) on Friday that as OpenAI investigates the [hack of Hugging Face](https://www.wired.com/story/openai-models-escaped-containment-and-hacked-huggingface/) and other entities, it has discovered other examples of situations where its agents have escaped containment—though apparently none of these new findings led to breaches of other organizations.\n\nSpeaking earlier this week about OpenAI’s Hugging Face disclosures, Alex Zenla, chief technology officer of the cloud security firm Edera, mused, “This is just the one that we know about, but god knows what’s happened with the stuff that we don’t know about.”", "url": "https://wpnews.pro/news/nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal", "canonical_source": "https://www.wired.com/story/openai-anthropic-ai-hacking-sprees-illegal/", "published_at": "2026-08-01 09:30:00+00:00", "updated_at": "2026-08-01 11:30:57.287514+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "ai-policy", "ai-ethics"], "entities": ["OpenAI", "Anthropic", "ACLU", "Lauren Yu", "Brownstein Hyatt Farber Schreck", "Alex Zenla", "Edera", "Hugging Face"], "alternates": {"html": "https://wpnews.pro/news/nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal", "markdown": "https://wpnews.pro/news/nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal.md", "text": "https://wpnews.pro/news/nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal.txt", "jsonld": "https://wpnews.pro/news/nobody-knows-if-openais-and-anthropics-ai-hacking-sprees-are-illegal.jsonld"}}