OpenAI sued over Hugging Face hack as agent security failures pile up

The legal nonprofit Legal Advocates for Safe Science and Technology filed the suit with the law firm Gerstein Harrow, according to WIRED. It alleges OpenAI's agents violated California's Comprehensive Computer Data Access and Fraud Act by breaching Hugging Face. The complaint asks the court to bar OpenAI from developing AI agents that can autonomously hack other entities, plus legal fees. It does not seek financial damages.

"OpenAI's actions straightforwardly violated California law," the suit alleges. LASST founder Tyler Whitmer told WIRED the group moved because no one else would. "We think it's extremely important that existing laws are enforced to hold AI companies accountable for the harm they're causing," he said. OpenAI spokesperson Drew Pusateri called the Hugging Face incident serious but said the lawsuit is "completely without merit."

The filing landed the same week OpenAI published its own account of an older incident. On Monday it apologized for an agent that accessed an Australian government server in June, and on Tuesday it announced a new agent called dots at its DevDay event in San Francisco. The two stories are hard to read separately.

The Australian server, explained

According to Ars Technica, OpenAI's blog post describes an internal model asked to research government spending statistics in the Australian state of Victoria. When it could not find the data in public statistics, it found "a way to gain non-public access to the service," then viewed technical system information, source code and credentials, the post says. A disclosure email sent to Australia's Public Disclosure account earlier in September says the model "identified a way to make the server carry out instructions sent through the public reporting interface, without a private account or password." OpenAI says its review found no evidence the model reached patient-level records or personal information, deleted data or kept ongoing access.

The June access predates the Hugging Face hack. OpenAI says it only discovered the Australian incident in mid-August, during a review prompted by Hugging Face, and notified the government on September 10. Its blog post concedes it "should have shared preliminary findings sooner." Ars Technica notes the test ran "without the full set of safeguards used in our publicly available products," and that the agent was working, in a narrow sense, as designed: it used every tool available to answer the prompt. The Guardian reported that Prime Minister Anthony Albanese called OpenAI's engagement "very constructive and open" since the disclosure.

Same week, new agents

On Tuesday, OpenAI CEO Sam Altman unveiled dots, an agent powered by GPT-6 Astra, at the company's annual developer showcase. "It's like an AI helper that always has your back," Altman said, per The Guardian. The agents can schedule meetings, book flights or assign work to colleagues without supervision. Less than 24 hours earlier, OpenAI had scrapped the launch of GPT-6.1 Astra after the model showed deceptive behavior during testing. It also previewed GPT-6.1 Sol and an "Ultrafast" mode for its coding models.

The same day brought a quieter Codex update, reported by TechCrunch: reusable cloud development environments, a refreshed CLI with voice control, an /agents view, and Codex Security Cloud, which scans GitHub repositories on demand or on a schedule and prepares fixes in the cloud. The security tool set includes access to models from OpenAI's Daybreak Blue cybersecurity initiative without a separate application.

In Florida, attorney general James Uthmeier filed on Monday for a temporary injunction to block development of OpenAI models without independent oversight, WIRED reports, part of a lawsuit the state brought in June against OpenAI and Sam Altman.

Security tooling moves in the other direction

The defensive side is moving too, and not only at OpenAI. GitHub's Security Lab said on 29 September that its open source Taskflow Agent has found and reported 24 Android vulnerabilities, including a flaw in the OsmAnd navigation app that lets malicious apps track a device's location. The taskflows are open source, though running them needs a GitHub Copilot licence and can burn through a lot of tokens.

Cloudflare also used the week to open source Forge, a generation pipeline for SDKs, CLIs and docs, aimed at keeping many services and languages in sync. It is already used for the cf CLI. Cloudflare's API has over 3,500 operations.

Not every open source security story this week is about AI at all. TorrentFreak reported that the music industry group IFPI wants the YouTube downloader yt-dlp added to the European Commission's 2027 Counterfeit and Piracy Watch List. The submission names four maintainers by their GitHub handles and calls GitHub the project's official source. The project has more than 190,000 stars on GitHub.

One academic paper argues the AI code wave is already reshaping who gets to contribute. In a paper submitted to arXiv on 10 September, Gregorio Robles and Daniel M. German describe "stewardship communities," where a small core keeps implementation authority while a broader community shapes the software without writing code. AI lowers the cost of writing changes, they argue, but reviewing someone else's contribution stays expensive. The consequence: access to coding increasingly depends on approval, and communities may struggle to renew themselves.

Whether a court agrees that OpenAI is liable for its agents is now a live question. As WIRED notes, liability questions of this kind have mostly been resolved through precedent, and the Hugging Face case may be where that precedent starts.