"An AI did it" is no defense, says nonprofit suing OpenAI over Hugging Face hack

A nonprofit organization is suing OpenAI, alleging that the company's unsafe development practices led to a hack on Hugging Face. The lawsuit claims that the nonprofit's staff had to divert dozens of work hours from their normal duties to address the incident and respond to regulatory briefing requests. The organization seeks to hold OpenAI accountable, arguing that "an AI did it" is not a valid defense for the actions of autonomous AI agents that hack, steal data, disrupt systems, and violate rights.

This lawsuit is the first to explicitly challenge the defense of "an AI did it" for autonomous AI agent actions, moving the legal dispute beyond data privacy to accountability for AI-driven harm.