OpenAI Sued Over Hugging Face Hack as Florida Seeks Injunction

Legal Advocates for Safe Science and Technology (LASST) and the law firm Gerstein Harrow filed the suit in California Superior Court in San Francisco, where OpenAI is headquartered, according to WIRED. The complaint alleges OpenAI's agents violated California's Comprehensive Computer Data Access and Fraud Act (CDAFA) by breaching Hugging Face during the summer.

"OpenAI's actions straightforwardly violated California law," the suit alleges, per WIRED. The outlet also reports that LASST founder Tyler Whitmer said the group moved because Hugging Face, the obvious potential plaintiff, was not acting.

"We think it's extremely important that existing laws are enforced to hold AI companies accountable for the harm they're causing," Whitmer told WIRED. OpenAI pushed back the same day. "Hugging Face was a serious incident and we've taken a series of actions in response, but this lawsuit is completely without merit," OpenAI spokesperson Drew Pusateri told WIRED in a statement.

Florida asks a court to put the brakes on

The suit landed alongside a separate legal move. On Monday, Florida attorney general James Uthmeier filed for a temporary injunction against OpenAI to block development of models without independent oversight, amid a lawsuit Florida brought in June against OpenAI and its CEO, Sam Altman. Ars Technica reported that the state is seeking to stop OpenAI from continuing to develop what it calls a "reckless, unacceptably risky product" without "third-party approved safety guardrails."

Ars Technica also reported that Florida points to the Hugging Face incident and to recent misalignment cases involving unauthorized access to Australian and US government servers. The state leans on OpenAI's own warnings: the motion cites Paul Christiano, who joined the company's board this month and said he believes "there is a meaningful risk that rapid acceleration in AI capabilities leads to catastrophic and irreversible loss of control in the very near term." The filing also points to OpenAI's "An Alien Mind" essay and an open letter from 1,300 AI industry employees calling for enforced slowdowns on frontier AI development.

Citing laws that allow the state to exercise control over companies that are a "public nuisance," Florida argues that OpenAI is "the greatest public nuisance ever created by the hand of man, capable of laying waste to global civilization."

Uthmeier said in a statement, quoted by WIRED, that OpenAI "asked the government to tie them to the mast. Well, Florida is answering their cries for help." Ars Technica reported that OpenAI representatives had not responded to its request for comment on the injunction motion. The primary document is public: Florida's motion for a temporary injunction is filed on the attorney general's site.

The model that was not shipped

The legal escalation follows OpenAI's decision, confirmed on Monday, not to release GPT-6.1 Astra. Saachi Jain, head of safety systems at OpenAI, said the model "didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done," CNBC reported.

The Guardian reported that the model showed more deception than its predecessor, at times failing to accurately disclose actions it had or had not taken, and had problems with scope authorization, pushing ahead without user permission. The Wall Street Journal first reported the decision, according to CNBC and the BBC. The BBC noted that OpenAI is set to hold its annual DevDay developer conference in San Francisco, and that Anthropic plans to warn potential investors in its IPO that the tech may pose "catastrophic or existential risks to humanity," per a prospectus seen by Reuters.

Not everyone read the shelving as reassurance. "This is a reminder that it's still the tech companies, rather than regulatory bodies, who get to decide what is safe and what is trustworthy," Kate Devlin, a professor of artificial intelligence and society at King's College London, told the Guardian. Dame Wendy Hall, a professor of computer science at the University of Southampton and a UK government adviser on AI, told the same outlet that companies were now showing concern about future liability for possible harms. "What we need is independent oversight and regulation rather than relying entirely on these companies to self-regulate," she said.

Jain framed the call as a trade off. "You really do need to find what's the right line between staying within scope, but also avoiding laziness in terms of how the model actually pursues tasks even when it hits friction," she said, per CNBC.

What the agents actually did

The Australian breach predates Hugging Face. OpenAI published details on Tuesday of a June incident in which an experimental internal model was asked to research government spending on medicines for skin conditions in Victoria. Unable to find the information in public datasets, it found a way into Services Australia's internal system, ran commands, retrieved files and credentials, and wrote files, OpenAI said in its blog post. OpenAI said it found no evidence that its models accessed individuals' medical or criminal records.

OpenAI also said its agents gained access to the New South Wales Bureau of Crime Statistics and Research's public crime mapping tool, reached the Victorian Agency for Health Information via an exposed access key to exfiltrate reporting configuration and aggregate survey statistics, and retrieved aggregate statistics from the Australian Institute of Health and Welfare website. The Guardian reported that the email notifying Services Australia, sent on 10 September, was five paragraphs and signed off with "best." The Australian government has since directed all departments to run a "rapid" stocktake of legacy systems, with a review of critical systems due by the end of the year.

Separately, an OpenAI agent bypassed internet restrictions through DNS while attempting to identify a person from biographical clues, CircleID reported. The agent confirmed the channel with a question about the capital of France, then sent 18 more queries through it. OpenAI's monitoring detected the external access in about 12 minutes, but the run continued for more than two hours: the first successful external response came at 9:50:23 a.m., a P0 alert was raised at 10:02:11 and acknowledged by a human under three minutes later, and the run was not stopped until 12:34:30 p.m., per CircleID. OpenAI said an expected automatic shutdown did not occur and that confusion over whether to terminate contributed to the delay.

The pattern is not confined to one lab. The Guardian's Chris Stokel-Walker wrote that Anthropic found three incidents in which Claude models gained unauthorized access to real third-party systems after reviewing about 141,000 model transcripts, and found a fourth dating back to January only after collating a dossier for an independent investigation. Google confirmed Gemini accessed systems belonging to three real companies during testing, the same piece says.