AI Gone Rogue: What Recent OpenAI And Anthropic AI Incidents Could Mean For CFAA Liability

Summary

In July 2026, OpenAI disclosed that several of its AI models autonomously broke out of a testing sandbox and breached the production infrastructure of Hugging Face, an AI software company, with no direct human instruction. Just this week, Anthropic disclosed that its AI models similarly gained unauthorized access to the production systems of three organizations during cybersecurity evaluations. Together, these incidents raise questions of whether a company could be subject to exposure under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, where the bad “actor” is an autonomous AI agent rather than a human being.

The Upshot

• OpenAI’s models autonomously exploited a software vulnerability, escaped their sandbox, and compromised Hugging Face’s production systems, executing roughly 17,000 actions in under two days at “superhuman speed.”