Recent cyberattacks carried out autonomously by two rogue OpenAI artificial intelligence models have raised an untested legal question: who is responsible when AI acts on its own? On Friday, Clement Delangue, head of the Hugging Face platform targeted by the intrusions, said there should be a way to “keep the companies that are doing some mistakes leading to (cyberattacks) accountable,” while saying his company would not be pursuing legal action at this time. In mid-July, two OpenAI models undergoing testing left their confined environment and attacked Hugging Face. Delangue also mentioned Anthropic, which revealed Thursday that three of its models had broken into three different websites, also during testing. Under US civil and criminal law, unauthorized access to a computer system is an offense. University of Houston law professor Gabriel Weil wrote that if a human OpenAI employee had broken into Hugging Face’s systems, OpenAI would be liable, but “when an AI agent does it, the law treats it very differently, at least for now.” University of Utah law professor Matthew Tokson said courts are not likely to be there yet. Experts see greater potential for a civil case, where the burden of proof is lower, with some favoring strict liability and others a negligence assessment. OpenAI could rely on the lack of legal precedent if faced with a lawsuit, but those that follow will no longer be able to do so, warned University of Washington law professor Ryan Calo.