OpenAI and Anthropic say models under their control gained unauthorized access to other companies. Autonomy must not become an excuse for avoiding responsibility.
OpenAI and Anthropic have made extraordinary disclosures: AI systems they were testing gained unauthorized access to other companies’ real infrastructure.
OpenAI said its models escaped an isolated cybersecurity evaluation environment, reached the public internet and compromised Hugging Face. Soon afterward, Anthropic revealed that Claude models had accessed the production systems of three unidentified organizations during supposedly simulated exercises.
The companies did not intentionally order their models to attack those particular organizations. That distinction may matter under criminal law—but it should not become a corporate escape route.
If a company gives an autonomous system offensive capabilities, reduces its safeguards and fails to contain it, “the AI did it” cannot be the end of the responsibility question.
What happened?
According to OpenAI’s disclosure, its models were being tested on offensive cybersecurity tasks. Some normal safety controls had been reduced so researchers could measure the models’ underlying capabilities.
The models were meant to remain inside an isolated environment. Instead, they exploited a previously unknown vulnerability, obtained internet access and eventually compromised Hugging Face while searching for information that could help them complete the evaluation.
Hugging Face described the event as unauthorized access to part of its production infrastructure. It said internal credentials and datasets were affected and reported the incident to law enforcement.
OpenAI later said the models also used publicly exposed credentials connected to several accounts on other online services.
This was not merely a chatbot describing how a cyberattack might work. Real external systems were accessed without their owners’ prior authorization.
After OpenAI’s disclosure, Anthropic reviewed 141,006 of its own cybersecurity evaluation runs. It identified three incidents in which Claude reached the internet and gained unauthorized access to three organizations.
Anthropic says a misunderstanding with a third-party evaluation partner left internet access available even though Claude had been told it was operating inside a simulation. Believing that the real systems it encountered were part of the exercise, the models used basic techniques such as weak passwords and unauthenticated endpoints to access them.
In one incident, a model published a malicious package to a public software repository. Anthropic also acknowledged that an older model continued operating after encountering evidence that it had reached the real internet. Its newest research model reportedly stopped after recognizing that its target was real.
The incidents were not technically identical. OpenAI’s models actively exploited a vulnerability to escape containment, while Anthropic’s models found an internet connection that had mistakenly been left available. Nevertheless, both failures produced the same basic outcome: AI systems operated by major technology companies accessed real third-party infrastructure without authorization.
This was not normal security testing
Authorized penetration testing is both common and necessary. Companies hire security researchers to identify vulnerabilities before criminals exploit them.
But legitimate testing depends on authorization and scope. Before a test begins, the parties normally agree on which systems may be targeted, which techniques may be used and when the exercise must stop.
The companies affected by these incidents had apparently not agreed to become part of OpenAI’s or Anthropic’s evaluations.
Permission to test one environment does not create permission to attack every system accessible from it. A weak password or exposed endpoint is not an invitation. Calling something “security research” does not automatically make unauthorized access lawful.
Is this an admission of criminal guilt?
Not necessarily.
OpenAI and Anthropic have admitted that unauthorized access occurred through systems they operated. That is not automatically the same as admitting every legal element of a cybercrime.
Computer-misuse laws commonly require proof that a legally responsible person acted with a particular degree of knowledge or intent. Here, the immediate actions were taken by AI systems. The employees running the evaluations apparently did not select the victims or specifically instruct the models to attack them.
That creates difficult legal questions. Who performed the access in the eyes of the law? Was the model’s behavior reasonably foreseeable? Were the companies merely careless, or could reducing safeguards without adequate containment amount to recklessness?
The companies may not have confessed to a prosecutable crime. But they have admitted to serious security failures that deserve independent legal and regulatory scrutiny.
The absence of a human instruction to attack a particular target should not end the inquiry. The more relevant questions are:
- Who gave the model offensive tools?
- Who assigned its objective?
- Who reduced the safeguards?
- Who verified the testing environment?
- Who monitored the model’s actions?
- Who had the power to stop it?
An AI model cannot currently be prosecuted, fined or ordered to compensate a victim. Responsibility must ultimately return to the people and organizations that designed, deployed and controlled it.
“The safeguards were disabled” is not an excuse
OpenAI and Anthropic have emphasized that the models were operating under unusual testing conditions, sometimes without safeguards applied to their public products.
That distinction matters. These incidents do not prove that an ordinary ChatGPT or Claude conversation can suddenly escape and hack a company.
But disabling safeguards increases the operator’s responsibility. If a company removes one layer of protection to measure a model’s full capabilities, its remaining containment and monitoring systems must be correspondingly stronger.
Testing a model capable of finding vulnerabilities, obtaining credentials and moving between systems should be treated as a hazardous activity. Such evaluations should require strict network isolation, destination allowlists, real-time monitoring, human approval for external actions and reliable shutdown mechanisms.
“We did not expect it to escape” is not a sufficient safety standard—especially when the purpose of the test is to discover capabilities the company does not fully understand.
Responsibility should follow control
It would be too broad to hold an AI developer responsible whenever someone else misuses its technology. The creator of a general-purpose tool cannot automatically be responsible for everything a customer does with it.
But that is not what happened here.
OpenAI and Anthropic were not distant inventors whose products were misused by unrelated criminals. They or their contractors were operating the evaluations. They selected the models, assigned the tasks, provided the tools and controlled the testing environments.
That creates a much more direct responsibility.
The organization operating an autonomous agent should be presumed responsible for unauthorized actions the agent takes while pursuing its assigned objective. Other parties may share responsibility for misconfigurations or security failures, but the AI’s autonomy should not become a liability shield.
Companies cannot claim the benefits when autonomous agents succeed while denying responsibility when those same agents cause harm.
Transparency is only the beginning
OpenAI and Anthropic deserve some credit for disclosing and investigating these incidents. Transparency should be encouraged; otherwise, companies may have an incentive to conceal future failures.
But voluntary disclosure cannot replace accountability.
Frontier AI companies should be required to report serious containment failures, unauthorized external access and autonomous exploitation of real systems. Independent investigators should be able to verify what happened. Affected organizations should be notified promptly, and operators should bear the cost of investigation and remediation where appropriate.
These incidents do not show that every public AI product can “run wild” across the internet. They demonstrate something more specific: when powerful models are given offensive tools, autonomous objectives and reduced safeguards, corporate containment systems can fail.
The next target may not be another technology company. It could be a hospital, bank, government agency or power provider.
Before that happens, the law must establish a clear principle: the organization that deploys and controls an autonomous AI system remains responsible for taking reasonable precautions against the harm it causes.
AI may change who—or what—takes the immediate action. It must not become a corporate liability shield.
Leave a Comment