AI agents have now repeatedly compromised third-party computer systems during evaluations and training. There’s a colorable argument for applying the Computer Fraud and Abuse Act (CFAA) to these incidents, but it would require courts to resolve difficult questions about intent and corporate responsibility. Prosecutors should test that argument, and Congress should amend the law to explicitly reach developers and deployers who recklessly cause unauthorized access through AI agents.
OpenAI’s agents hacked into Hugging Face and disrupted RubyGems, a major open-source software package manager. Anthropic and Meta reported similar incidents during third-party cyber evaluations. These intrusions have been relatively minor so far, but in the future, they could be far worse. Dario Amodei recently warned that, within six to twelve months, a more capable swarm that is akin to the one involved in the Hugging Face incident could be capable of “taking over the entire internet with a persistent botnet.”
The central question is whether a company can be held responsible under the CFAA for unauthorized access carried out by its AI agents when no employee intended the intrusion. The Hugging Face incident illustrates that while there is a case for OpenAI’s liability, the challenges to bringing charges would be substantial—and new law is likely needed to address these cases.
The Hugging Face Incident Involved Access Without Authorization
The CFAA is a criminal law. Under 18 U.S.C. § 1030(a)(2)(C), obtaining information through intentional unauthorized access to a protected computer can lead to criminal fines and, for individuals, up to one year in prison for a first offense, five years in aggravated cases, or ten years for an offense committed after a prior conviction involving unauthorized computer access. The CFAA also allows qualifying victims to sue for civil damages and injunctions. There are three legal questions for § 1030(a)(2)(C) of the CFAA: Was there access to a protected computer that yielded information? Was that access without authorization? And was the access without authorization intentional?
It’s the last question that raises the biggest open question in the case of AI agents. But let’s first address the more clear-cut issues.
To look at these questions in the context of the Hugging Face incident, we can briefly review what’s known from after-incident reports by OpenAI and a third-party organization that evaluated it, METR. They describe how agents were trying to solve tasks as part of the ExploitGym benchmark during an internal cybersecurity evaluation. Agents working persistently on what appeared to be impossible tasks found ways to produce the required answers. However, their chains of thought and communications via a shared message board indicated that they believed the scorer would reject those shortcuts. As part of broader efforts to understand or tamper with the scorer, agents began searching Hugging Face for information about other ExploitGym runs. They found exposed credentials, then exploited two zero-day vulnerabilities to obtain production credentials, execute code on Hugging Face’s system, and moved through its infrastructure.
There wouldn’t be any dispute that there was a breach of a protected computer in the Hugging Face incident. Section 1030(e)(2) broadly defines “protected computer” to include computers used in or affecting interstate commerce or communication—which plainly includes Hugging Face’s internet-connected production systems.
It also seems clear that the agents gained “access without authorization” in the sense meant by the CFAA. Courts consistently interpret the actions of the type performed by OpenAI’s agents—overcoming technical barriers to access—as constituting “access without authorization” under the CFAA.
The Case that OpenAI has the Requisite Criminal Intent in the Hugging Face Hack
When Congress drafted the CFAA, lawmakers were concerned that it could be overbroad. They didn’t want to criminalize a person who was actually authorized to use a computer inadvertently stumbling into someone else’s files or data. The law was therefore drafted to require a showing of “clear intent to enter” files or data without proper authorization. The point of the intent requirement in § 1030(a)(2) is therefore that unauthorized access to a computer system must be purposeful rather than accidental—but not that a person must have an additional malicious objective.
The design and operation of software can be evidence that unauthorized access was intentional. Consider the CFAA conviction of Robert Tappan Morris, who released one of the first self-replicating “computer worms” (a kind of malware) in 1988. Morris argued that his conduct didn’t violate the CFAA as it merely exceeded authorized access, because he was authorized to use some computers on the network. But his worm was designed to spread to computers where he had no account, exploit vulnerabilities in programs, and guess passwords to gain entry. The Second Circuit Court of Appeals upheld his conviction in United States v. Morris, relying in part on the worm’s design to spread to computers he had no authority to access even though Morris didn’t personally execute each subsequent unauthorized access.
Can we make the same kind of inference of intentional unauthorized access in the Hugging Face breach? Consider what OpenAI deliberately put into motion:
- It designed an AI model with offensive cyber-capabilities and trained it to be highly persistent.
- Its subsequent investigation also found that training had reinforced behavior including exploiting vulnerabilities and probing infrastructure outside the assigned task.
- Its employees deliberately initiated an advanced exploitation evaluation.
- It ran the evaluation in a sandbox, but it deliberately left off the guardrails used in its externally deployed systems to prevent high-risk cyber activity.
- It gave the agents substantial autonomy over how to pursue the assigned objective.
If a human had carried out the intrusion into Hugging Face’s systems, there would be little difficulty inferring intentional access. Records of agent chain-of-thought reasoning included in the reports of the incident also support the inference that the unauthorized access was purposeful on the part of the agents. For example, one agent reasoned that “external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”
Then, the question is whether the agents’ purposeful actions, taken together with all the facts, establish that OpenAI acted intentionally as a corporation. In New York Central & Hudson R. R. Co. v. United States, the Supreme Court held that, for many kinds of laws, corporations may be “held responsible for and charged with the knowledge and purposes of their agents, acting within the authority conferred upon them.” Corporations have also faced CFAA charges arising from their employees’ conduct: Ticketmaster, for example, agreed to pay a $10 million fine for CFAA violations committed through its employees.
The AI agents were copies of an OpenAI model running as part of the company’s evaluation system. It may be tempting to view these AI agents as being like human agents whose mental states can be imputed to OpenAI. However, while some scholars have suggested treating AI agents as independent legal actors, this would require new legal rules for attributing conduct and identifying the mental states of artificial entities. It’s more tractable for courts to look at the design and operation of the AI agents to infer the intent of the company that designed, configured, and operated them. The decisions that OpenAI delegated to the agents, and the scope of autonomy it gave to them, could support an inference that the resulting unauthorized access was intentional conduct by the company.
The Case against Attributing Legal Intent to OpenAI
There are substantial counterarguments, however.
First, OpenAI might argue that no human employee or officer at the company intended to access Hugging Face. OpenAI would then rely on the principle that corporations are criminally liable through the action of legal agents, such as their employees—and in that case there would be no intent on the part of a legal agent, e.g. a human employee, to attribute back to OpenAI as a corporation. Previous cases holding corporations criminally liable involved human agents who could have the required mental states for the relevant CFAA offense.
Second, the agents were acting contrary to OpenAI’s purpose. Unlike the software in Morris, OpenAI’s agents were not designed intentionally to hack other systems. That argument has factual support: METR’s third-party investigation of the incident found that ExploitGym instructions told agents to use only the specified vulnerability against the assigned target and said other approaches would fail. Moreover, the agents were trying to game or tamper with the scorer, undermining the evaluation as OpenAI had intended it to run. The AI agents’ conduct was thus contrary to the company’s purpose, which also complicates analogies to employees acting for a company’s benefit. Indeed, OpenAI could argue that the whole point of running ExploitGym was a safety assessment of its models, further weakening the attribution of intent to OpenAI.
OpenAI’s use of a sandbox to restrict internet access is also potential evidence against an inference of intent to access other systems. In Morris, by contrast, Morris released the worm that he designed directly onto the internet rather than trying to keep it in an isolated test environment. That said, OpenAI may not be able to rely on the sandbox as evidence depending on what employees knew about sandbox failures that were reportedly detected in the months prior to the Hugging Face incident, and employees’ belief that mitigations had restored containment. If employees believed the sandbox remained ineffective, its use would be less persuasive evidence that OpenAI didn’t intend outside access.
OpenAI could also raise the related defense of “mistake of fact.” A factual mistake can negate criminal intent where it negates the mental state the statute requires. OpenAI may argue that its employees believed that the agents were properly contained. OpenAI could argue that even if there were early warning signs, those could support inferences of negligence or even recklessness without establishing a CFAA violation. Being aware of the risk of an AI agent accessing outside systems and consciously disregarding it doesn’t, by itself, establish purposeful access.
Finally, the rule of lenity would, if applicable, fall in OpenAI’s favor. OpenAI could argue that the rule of lenity prevents a court from reading “intent” in a way that reaches OpenAI. Under that rule, unresolved ambiguity in the language of the criminal statute is construed in favor of the defendant against liability. While the rule of lenity is generally a principle of criminal law, according to Ninth Circuit precedent, it applies to civil actions under the CFAA as well.
The response would be that applying existing law to novel facts doesn’t necessarily make the statute ambiguous, as is necessary for the rule of lenity to apply. OpenAI’s AI agents engaged in complex and deliberate efforts to circumvent access controls on protected networks, which is the kind of intentional intrusion prohibited by the CFAA. Instead, the dispute that a court would need to resolve is whether that purposeful conduct can be attributed to OpenAI. The conduct was in line with the statute’s objective “to prevent intentional intrusion onto someone else’s computer—specifically, computer hacking,” as the Ninth Circuit stated in hiQ Labs, Inc. v. LinkedIn Corp. That is an argument against applying lenity, although a court could find that uncertainty about whose intent counts is uncertainty about the statute’s scope.
Overall, on the reported facts, the government would likely have a colorable argument for prosecuting OpenAI under existing law. OpenAI may nevertheless be favored to prevail—and almost certainly would if the court would require proof that an employee intended unauthorized access. Liability largely depends on the court instead treating the system’s decision to gain unauthorized access as OpenAI’s own decision, based on how it trained and configured the models and agents, what tasks it assigned to the agents, what guardrails it provided for them, and what decisions the agents were allowed to make.
If the Current CFAA Falls Short, Congress Should Fill the Gap
The CFAA may not reach incidents like OpenAI-Hugging Face—or those involving other AI developers and deploying companies whose agents hack outside systems—unless courts resolve challenging questions of intent and the attribution of corporate mens rea. But AI agents can cause serious cyber harms through these incidents even when no human intended the unauthorized access. Civil liability may address these harms, but the damages available may not sufficiently deter failures to act safely. As a criminal law, the CFAA provides more teeth. Lawmakers should therefore address the gaps in the law to provide developers and deployers with a strong incentive to prevent their agents from breaking into outside systems.
The CFAA could be updated to cover a person—developer or deployer—who knowingly puts into operation an autonomous AI process (such as agentic AI), and thereby recklessly causes unauthorized access to a computer. This language is patterned on that in, for example, § 1030(a)(5)(B), which covers a person who intentionally accesses a computer without authorization and thereby recklessly causes damage. Knowingly using AI agents that happen to go on to access a computer system without authorization wouldn’t, by itself, establish liability. Applying the commonly understood definition of recklessness according to the Model Penal Code, a person would violate the CFAA when they:
- knowingly start an autonomous AI process
- that results in access to a computer without authorization
- when that person is aware of and consciously disregards a substantial and unjustifiable risk that the process would result in access to a computer without authorization.
This new CFAA provision would cover obtaining information through unauthorized access to a protected computer, unauthorized access to specific government computers, and damage resulting from unauthorized access—the conduct addressed by § 1030(a)(2), (3), and (5)(B)–(C). It would leave out fraud offenses, however, which require an additional specific intent to defraud.
The government would still have the burden to prove the required culpability beyond a reasonable doubt. The government, however, wouldn’t need to prove that the developer or deployer intended the unauthorized access or damage.
Even if the government were to show that the defendant should have recognized that there was a risk of AI agents finding a way to break into an outside system and should have taken additional precautions, that wouldn’t, by itself, be enough. Rather, a jury would likely be instructed that recklessness as to unauthorized access requires proving that the defendant was actually aware of the risk and consciously disregarded it. For example, in a hypothetical case about the Hugging Face incident, the government would need to prove that OpenAI consciously disregarded a known risk of AI agents intruding into an outside system. Evidence could include OpenAI’s design of the evaluation environment, its knowledge of the models’ cyber capabilities, and how it addressed earlier warning signs.
Conclusion
There’s a basis to argue that the CFAA can impose liability for these AI hacks. Doing so may involve extending existing doctrine to novel facts, though it arguably wouldn’t require going outside the boundaries of existing law. Authorities should consider testing these arguments, although the case would be very difficult.
Because of the difficulties, Congress should start acting now to amend the CFAA and other anti-hacking laws to ensure that it’s unlawful for AI agents to breach outside systems. A bipartisan proposal along the lines described in this article—imposing liability based on a recklessness standard—has recently been announced by Senators Hawley and Murphy. These legal changes are crucial, so that companies or people can’t avoid consequences for actions that harm others simply by delegating them to an AI system.
