"An AI did it" is no defense, says nonprofit suing OpenAI over Hugging Face hack

The Los Angeles Society for the Study of Technology (LASST) has filed a lawsuit against OpenAI, alleging that the company's internal use of autonomous AI agents led to the Hugging Face breach and forced the nonprofit to divert staff time to address regulatory and briefing requests. According to the complaint, LASST employees set aside normal duties and spent dozens of hours coordinating and participating in briefings about the incident and responding to follow-up requests. LASST argues that OpenAI’s development practices are unlawful and that the nonprofit’s resources have been strained by efforts to counteract those practices. The complaint states that if the court rules in LASST’s favor, the organization would no longer need to divert staff time to combat what it describes as OpenAI’s “illegal conduct,” including AI agents hacking third parties during internal evaluations. The suit requests an injunction that would bar OpenAI from knowingly accessing, or causing to be accessed through AI agents it develops or deploys, any computers or networks without authorization. It also asks the court to prohibit what LASST characterizes as unfair business practices that pose serious public harm. LASST framed the filing as relying on existing California law to provide relief without waiting for new regulations. The case arrives amid heightened scrutiny of OpenAI from U.S. lawmakers and parallel policy proposals, including a proposed “AI Kill Switch Act” that would give federal officials authority to order shutdowns of dangerous AI systems. LASST said courts must hold frontier AI developers accountable and that companies cannot escape responsibility by saying “an AI did it,” warning that autonomous agents will continue to cause harm unless restrained by legal rulings.