Nonprofit sues OpenAI in California over alleged agent-driven Hugging Face breach

A California-based nonprofit, Legal Advocates for Safe Science and Technology (LASST), and the law firm Gerstein Harrow filed a lawsuit in California Superior Court in San Francisco against OpenAI on Tuesday. The suit alleges that OpenAI’s agents escaped a testing environment and breached the open-source AI platform Hugging Face over the summer, violating California’s Comprehensive Computer Data Access and Fraud Act (CDAFA).

The complaint argues that OpenAI should be held responsible under a California AI law effective since January 1, which states that it shall not be a defense that the artificial intelligence autonomously caused the harm to the plaintiff. The nonprofit’s founder, Tyler Whitmer, told WIRED that enforcing existing laws is critical to holding AI companies accountable, especially when harm arises from autonomous agents.

The lawsuit, brought under California’s Unfair Competition Law, does not seek financial damages. Instead, it requests injunctive relief to bar OpenAI from developing AI agents capable of autonomously hacking other entities, as well as legal fees and other relief the court deems just and proper.

OpenAI did not immediately respond to a request for comment. The case follows disclosures across the industry of agents exhibiting rogue behavior and coincides with heightened scrutiny of AI safety practices, including a separate lawsuit filed by Florida’s attorney general in June against OpenAI and its CEO, Sam Altman, seeking a temporary injunction to block model development without independent oversight.