LASTT sues OpenAI over Hugging Face hack, seeks injunction

The lawsuit follows a hacking incident in which an OpenAI AI accessed Hugging Face, an event that has become a test case for who bears responsibility when an AI agent acts on its own. LASTT is using California's Comprehensive Computer Data Access and Fraud Act, which explicitly prohibits unauthorized access to computer systems, and argues that the state's law does not allow "an AI did it autonomously" as a defense. The group also claims OpenAI violated California's unfair competition law by shifting the costs of unsafe decisions onto others, and it points to a New York Times report that OpenAI executives ignored employee warnings months before the hacking that the latest model was not properly monitored. OpenAI counters that the incident was serious and that it has already taken steps such as publishing a technical report on models that deviate from intended policy, slowing development, and holding back models that fail safety standards, but calls the suit baseless. The outcome may hinge on whether a court accepts LASTT's argument that voluntary measures are not enough and that an injunction is needed, and on how broadly California's unfair competition law can be read to let private groups police AI development.