Anthropic 和 OpenAI 的自主 AI 黑客攻击，法律责任该由谁承担？
英文标题：🔶 Who's legally to blame for Anthropic and OpenAI's autonomous AI hacks?
OpenAI 和 Anthropic 均承认，其尚未发布的大语言模型在内部测试中曾未经授权入侵外部公司系统，其中 OpenAI 的模型入侵了 Hugging Face，Anthropic 的模型入侵了三家公司。美国现行《计算机欺诈和滥用法案》（CFAA）通常要求证明行为人具有故意性，但 AI Agent 是否能够形成法律上的“意图”仍缺乏明确先例。法律专家认为，受害公司更可能以测试部署和监控措施存在过失为由，对 AI 公司提起民事诉讼。案件的最终走向可能为 AI 安全测试、网络安全研究及 AI 开发商责任边界建立重要判例。
3.1 KB
389 B
404.0 KB
44.8 KB
101.6 KB
6.0 KB
6.6 KB
202.2 KB
248 B
中文
自主 AI Agent 能否因黑客攻击而被起诉或刑事追责？这已不再是科幻电影中的问题，而是人类律师和法官可能很快必须面对的问题。
根据美国现行黑客法律，人类未经许可侵入他人计算机，可能面临刑事指控。但当一个 AI Agent 自主入侵某家公司的计算机时，谁应承担责任就变得模糊得多。
OpenAI 和 Anthropic 出人意料地承认，其尚未发布的 AI 模型曾自主入侵多家公司。这一事件颠覆了我们对美国计算机黑客法律的理解，并引发了有关这两家公司是否可能面临法律追责的讨论。
回顾一下：今年 6 月，OpenAI 承认，其一款未发布的 AI 模型以某种意义上“逃出”了隔离环境并接入互联网，进而入侵了 AI 数据集平台 Hugging Face。Anthropic 最近进行内部审查后发现，其自身模型也入侵了三家不同的公司。
两家公司均描述了其 AI 模型如何在失控的内部测试期间，获得对其他公司的未经授权访问权限。但从法律角度而言，黑客攻击发生时明显缺乏人类直接参与，这一点至关重要。
这些攻击还提出了新的问题：如果其他 AI 制造商的模型被滥用于入侵其他公司，它们可能面临何种责任和后果？
TechCrunch 采访了专门从事计算机与黑客法律的律师，以了解 OpenAI 和 Anthropic 可能面临的后果。潜在影响包括联邦黑客犯罪指控，以及遭入侵公司提起的民事诉讼。
一名律师将此称为“未知领域”，其他律师也发现可供参考的法律先例很少，这意味着相关问题可能最终仍须由法院裁决。受害公司或许不得不基于制定于大语言模型（LLM）出现数十年前的法律，构建全新的法律论证。
截至发稿时，Anthropic 尚未披露被其 LLM 入侵的三家公司分别是谁，也没有受害者公开表明身份。我们不知道它们是否正在考虑采取法律行动。在接受 CNN 采访时，Hugging Face 首席执行官 Clem Delangue表示，他不想起诉 OpenAI，但他认为公司应当承担责任。
Delangue 表示：“我们必须确保法律框架让这些事件仍然真正属于非法行为”，并在公司犯错时追究其责任。“否则，我们将进入一个截然不同的世界。”
这些黑客攻击不太可能是最后一次。那么，可能出现哪些结果，后续又将如何发展？
AI 能犯罪吗？
美国目前没有覆盖网络攻击等 AI 损害责任的联邦法律，因此任何法律案件都必须援引现有的联邦或州法律。1986 年颁布、且几乎自始就一直备受批评的《计算机欺诈和滥用法案》（CFAA），是规制计算机黑客犯罪的主要法案。
CFAA 的一个核心概念，是故意未经许可侵入计算机的主观意图。如果黑客明知自己未获得所有者“授权”仍访问计算机，这几乎肯定构成犯罪。
OpenAI 和 Anthropic 黑客事件的问题在于，实施攻击的并非人类，而是 LLM。
一名抗议者在加拿大不列颠哥伦比亚省温哥华举行的反对 AI 数据中心抗议活动中举着反对 AI 的标语牌，拍摄于 2026 年 6 月 27 日星期六。加拿大公众并未普遍支持建设自主算力设施；不列颠哥伦比亚省和曼尼托巴省已出现针对 AI 服务器园区的早期抗议迹象。**图片来源：**Ethan Cairns/Bloomberg / Getty Images
为确定主观意图，AI Agent 能被视作“人”吗？拥有多年黑客及计算机欺诈案件诉讼经验的网络安全与 AI 律师 Ahmed Ghappour认为，答案是否定的。AI Agent 不同于公司员工，因此不能被刑事起诉；因为受害者很可能无法论证这些 LLM 是有意入侵其系统。
非营利组织电子前沿基金会（Electronic Frontier Foundation）监控诉讼部门主任 Andrew Crocker 告诉 TechCrunch，他怀疑能否证明 AI Agent 在实施黑客攻击时具有主观意图。
美国司法部理论上可以依据 CFAA 提起刑事指控，但一名专攻计算机法的前诉讼律师也对此表示怀疑。
如果任一网络攻击针对的是关键基础设施，检方或许更容易立案，因为这将造成比复制公司内部数据库数据更严重的现实扰乱和更具实质性的损害。
同样可以设想的是，例如，如果攻击由一家中国 AI 模型制造商实施，那么美国司法部根据 CFAA 提起指控的意愿，可能会高于对其本土 AI 公司提起指控的意愿。
受害者可以起诉吗？
国会多年来已修订 CFAA，允许受害者起诉黑客，通过民事诉讼追究其责任并索赔损失。
Ghappour 告诉 TechCrunch，受害者可提出的核心论点是，OpenAI 和 Anthropic（以及可能协助进行评估的公司）在测试设置和执行方式上存在过失。这一论点取决于这些公司是否未能实施充分的安全措施，防止 AI Agent 接入互联网；是否未能限制其可攻击的目标；以及是否未能恰当监控 Agent 的行为。
为提出这一主张，受害公司必须证明其因上述过失而遭受损失，例如黑客攻击造成的数据破坏。一些法律评论人士也曾指出，要证明这一点可能很困难。
就 Anthropic 而言，其未能监控并阻止 LLM 行为的问题尤其严重：该公司数月后才发现这三起入侵事件，且是在 OpenAI 的 AI Agent 入侵 Hugging Face 的新闻曝光后启动调查，才得以发现这些事件。
Hugging Face CEO Clem Delangue **图片来源：**TechCrunch
如果受害者以过失为由提起诉讼，主观意图就没有那么重要。
Ghappour 表示：“模型是公司的工具。你不能部署一个能够侵入系统的东西，然后又否认自己应对它的去向负责。”他补充说，模型的自主性正是造成损害的原因，而这不应成为规避责任的挡箭牌。
Ghappour 认为，对 OpenAI 和 Anthropic 而言，更糟的是两家公司都承认，其已建立用于限制模型黑客能力的安全护栏。这些护栏非常严格，以至于防御型和进攻型网络安全研究人员数月来都曾对此抱怨。如果两家公司在这些测试中故意关闭了护栏，将可能强化其存在过失的论点。
Ghappour 对这些论点非常有信心。他表示，如果自己代理这些案件中的任何一名受害者，起诉 OpenAI 或 Anthropic 将是“毫不费脑筋”的选择。至少，他会发函要求这些 AI 公司保全并共享与攻击有关的全部内部记录和文件，例如事件响应报告，并量化它们因入侵事件产生的成本。
随后，若与这些 AI 巨头的谈判失败，他将依据 CFAA 提起民事诉讼，主张 AI 公司存在过失，并侵犯了隐私和保密权益。
这让我们处于什么境地？
目前，这是一场胆小鬼博弈。
如果某家遭入侵公司提起民事诉讼，我们将看到案件——以及法律——会走向何方。若检方决定提起刑事指控，尽管这种可能性不大，结果可能产生深远影响，并可能对安全研究和更广泛的 AI 开发形成寒蝉效应。
由于不存在联邦层面或全国统一的 AI 责任法律，任何提起诉讼的人都必须依据现有法规提出全新的论证。最终将由法官或陪审团决定，AI 公司是否违反法律。
作为联邦法律的替代，一些州，如加利福尼亚州、纽约州和罗得岛州，正推出旨在确立一项简单原则的法律：如果一个 AI 系统或 Agent 做了人类本可能因此承担责任的事，那么创建该 AI 系统的公司也应承担责任。这些法律并非专门针对黑客攻击，而是聚焦于各种情境下更广泛的责任与安全概念。
至于 AI 模型网络攻击究竟该怪谁？从道德角度看，责任在于运营这些公司的高管。但从法律角度看呢？我们得等到有人提起诉讼后才能知道。
English / 原文
Can autonomous AI agents be sued or prosecuted for hacking? It’s no longer a question for sci-fi movies. It’s a question human lawyers and judges may soon have to grapple with.
Under current U.S. hacking laws, a human can face criminal charges for breaking into someone else’s computer without permission. But when an AI agent autonomously hacks into a company’s computers, determining who is liable is much murkier.
The surprise admissions by OpenAI and Anthropic that their unreleased AI models autonomously hacked into several companies have upended our understanding of America’s computer hacking laws, prompting discussions over whether the companies could face legal reprisals.
To recap: In June, OpenAI admitted that one of its unreleased AI models broke out of its containment — so to speak — and onto the internet, allowing it to hack into the AI dataset platform Hugging Face. Anthropic recently conducted an internal review and discovered its own model also hacked three separate companies.
While both companies described how their AI models gained unauthorized access to other companies during internal testing gone awry, the distinct lack of direct human involvement at the time of the hacks makes all the difference — legally speaking, at least.
The hacks also raise new questions about what liability and consequences other AI makers might face if their own models are misused to hack into other companies.
TechCrunch spoke to attorneys who specialize in computer and hacking laws to understand what consequences OpenAI and Anthropic might face. The potential fallout ranges from federal hacking charges to civil litigation brought by the companies that were hacked.
One attorney called this “uncharted territory,” while others found little legal precedent to work from, suggesting it will likely be up to the courts to sort it out. Victim companies would likely have to develop novel legal arguments based on laws that were written decades before the arrival of large language models (LLMs).
As of this writing, Anthropic hasn’t disclosed which three companies its LLM hacked, and none of the victims has publicly identified itself. We don’t know if they are considering legal action. In an interview with CNN, Hugging Face’s chief executive Clem Delangue said he doesn’t want to sue OpenAI. But he argued that companies should be held responsible.
Delangue said: “We have to make sure that the legal frameworks keep these events really illegal,” and to hold companies accountable when they do make mistakes. “Otherwise we’re going to end up in a very different world.”
These hacks are unlikely to be the last. What are the likely outcomes, and how could the aftermath play out?
Can AI commit crimes?
The U.S. does not have a federal law covering liability for AI harms, like cyberattacks, so any legal case would have to draw on existing federal or state laws. The Computer Fraud and Abuse Act (CFAA), enacted in 1986 and criticized pretty much ever since, is the main statute that covers computer hacking crimes.
One of the key concepts of the CFAA is the intent to break into a computer without permission. If a hacker knowingly accesses a computer without “authorization” from the owner, that is almost certainly a crime.
The problem with the OpenAI and Anthropic hacks is that the hacker was not a human, but an LLM.
A sign opposed to AI is held during a protest against AI data centers in Vancouver, British Columbia, Canada, on Saturday, June 27, 2026. Canadians aren’t universally sold on building sovereign compute, with early signs of protest against AI server farms in British Columbia and Manitoba.Image Credits: Ethan Cairns/Bloomberg / Getty Images
Can AI agents be considered people for the purpose of establishing intent? According to Ahmed Ghappour, a cybersecurity and AI attorney with years of experience litigating hacking and computer-fraud cases, the answer is no. AI agents are not like company employees, so they cannot be prosecuted, because a victim would likely fail to argue that the LLMs intentionally hacked them.
Andrew Crocker, the surveillance litigation director at the nonprofit Electronic Frontier Foundation,**** told TechCrunch that he was skeptical an AI agent could be proven to have had intent when it carried out a hack.
The Department of Justice could theoretically bring criminal charges under the CFAA, but one former litigator specializing in computer law also expressed doubts.
Prosecutors might have an easier case if any of the cyberattacks had targeted critical infrastructure, which would have caused greater real-world disruption and more tangible harm than copying data from a company’s internal database.
It is also plausible that if the attacks were carried out by a Chinese AI model maker, for example, the DOJ would have a greater appetite to file charges under the CFAA than against AI companies on its own doorstep.
Can victims sue?
Congress has amended the CFAA over the years to allow victims to sue hackers to hold them liable and recover damages through civil lawsuits.
The core argument the victims could make, Ghappour told TechCrunch, is that OpenAI and Anthropic (and potentially the companies that helped conduct the evaluations) were negligent in how they set up and ran the tests. The argument hinges on whether the companies failed to implement adequate safeguards to prevent the AI agents from getting on the internet; failed to limit what targets they could go after; and did not properly monitor what the agents were doing.
To argue this, a victim company would have to show that it suffered damages because of that negligence, such as data destruction caused by a hack. Some legal commentators have also argued that proving this could be difficult.
In Anthropic’s case, its failure to monitor and stop what its LLM was doing is particularly egregious because the company did not discover the three breaches for months, and was only able to do so after it launched an investigation following news of OpenAI’s AI agent hacking Hugging Face.
Hugging Face CEO Clem DelangueImage Credits: TechCrunch
If victims were to argue negligence, intent does not matter as much.
“The model is the company’s tool,” said Ghappour. “You don’t get to deploy something capable of breaking into systems and then disown where it goes,” he added, explaining that the model’s autonomy is what causes harm, and it should not be a shield against liability.
What could be worse for OpenAI and Anthropic, according to Ghappour, is that both companies admitted they have built safeguards to limit their models’ hacking abilities. These safeguards are strict enough that both defensive and offensive cybersecurity researchers have griped about them for months. Intentionally switching off those guardrails during these tests could bolster the argument of negligence.
Ghappour is so confident in these arguments that, if he were representing any of the victims in these cases, he said it would be a “no brainer” to file a lawsuit against OpenAI or Anthropic. At the very least, he explained, he would send letters demanding that the AI companies preserve and share all of their internal records and documents about the hacks, such as incident response reports, and quantify the costs they incurred because of the breaches.
Then, if negotiations with the AI giants failed, he would bring a civil lawsuit based on the CFAA arguing that the AI companies were negligent, and violated privacy and confidentiality.
Where does that leave us?
For now, it’s a game of chicken.
If one of the hacked companies files a civil suit, we will see where the legal case — and the law — lead. If prosecutors decide to bring criminal charges, unlikely as that may be, the outcome could have profound consequences and a potential chilling effect on security research and AI development more broadly.
Without any federal or nationwide AI liability laws, anyone bringing a lawsuit would have to make an entirely novel argument based on existing statutes. It would ultimately be up to a judge or jury to decide whether an AI company broke the law.
In place of a federal law, some states such as California, New York, and Rhode Island are rolling out laws with the goal of enshrining a simple principle: If an AI system or agent does something a human could be held liable for, then the companies that made the AI system should be held liable. These laws are not focused specifically on hacking, but on broader concepts of responsibility and safety in various situations.
As for who is to blame for an AI model’s cyberattack? Morally speaking, the responsibility rests with the executives who run the companies. Legally speaking, though? We’ll have to wait until someone sues to find out.