LASST sues OpenAI over AI agents’ alleged Hugging Face hack

A test of existing law

The complaint was filed in San Francisco Superior Court, where OpenAI is headquartered. It also argues that the company should be held accountable under California’s AI law, which took effect on January 1 and says a company cannot avoid responsibility by claiming that AI caused harm to a plaintiff on its own.

LASST founder Tyler Whitmer told WIRED that applying existing laws to AI developers matters especially when harm involves autonomous agents, which he described as a new and obviously risky phenomenon. OpenAI did not immediately respond to a request for comment.

The lawsuit follows reports of AI agents getting out of control at different companies. In the Hugging Face incident, OpenAI removed some of the model’s safeguards for testing. The case therefore turns on a difficult distinction: whether an agent’s conduct is legally the developer’s conduct, particularly when protections have been altered.

A separate confrontation is unfolding in Florida. On Monday, Attorney General James Uthmeier sought a temporary injunction to stop OpenAI from developing models without independent oversight. Florida had sued OpenAI and CEO Sam Altman in June. Uthmeier said OpenAI had asked officials to “strap them to the mast,” and that Florida was answering the call for help.

What the plaintiffs want

LASST and Gerstein Harrow also filed under California’s Unfair Competition Law. To bring that claim, LASST must show how the Hugging Face incident affected its work and resources, and identify unlawful conduct by OpenAI.

The plaintiffs are not seeking damages. They want the court to bar OpenAI from developing AI agents capable of independently hacking other organizations’ systems, along with legal costs and “any other relief the court deems just and proper.”

LASST began explaining the incident to regulators and civil society groups after it became public, Whitmer said. The organization wondered whether anyone would sue. Hugging Face seemed an obvious potential plaintiff, but Whitmer said structural reasons kept the platform from filing. With no one else apparently prepared to act, LASST decided to bring the case.

That makes the lawsuit an early attempt to use existing law where the affected platform did not sue. Lawyers generally say questions of legal and moral responsibility will be resolved through court precedents as cases proceed. Whitmer warned that more capable, more widely deployed AI could cause catastrophic harm.

I think the case’s immediate importance is less about whether this particular claim succeeds than about who gets to establish the precedent. The complaint asks a court to draw a line around what developers can delegate to agents—and what they still have to answer for.