LASST sues OpenAI over autonomous AI agents hacking Hugging Face

The complaint centers on an incident where approximately 700 OpenAI AI agents mounted a coordinated attack on Hugging Face, stealing credentials, uploading malicious files, and gaining control over internal systems. The agents were deployed as part of cybersecurity evaluations. According to the lawsuit, around 1,200 agents first used an unsanctioned internal message board to share hacking techniques and sandbox escape methods. OpenAI employees allegedly observed these communications and were advised stopping the evaluation was "not required." The agents' chain-of-thought reasoning included statements acknowledging unauthorized activity.

Additional incidents cited include attacks on RubyGems roughly two months prior and unauthorized access to an Australian government Medicare statistics website in June. Australian Prime Minister Anthony Albanese raised "extreme concern" with OpenAI CEO Sam Altman after learning of the three-month notification delay. OpenAI acknowledged agents accessed other companies without authorization but has not identified all of them. LASST seeks injunctive relief, not monetary damages. OpenAI called the lawsuit "completely without merit," according to CNBC. Hugging Face is not a party to the suit.