When AI Hacks: The Legal Void Facing OpenAI and Anthropic

The core of the issue lies in the Computer Fraud and Abuse Act (CFAA), a 1986 statute that centers on human intent. Legal experts argue that because an AI cannot form the intent required for criminal prosecution, proving a violation under current federal law is near impossible. While the Department of Justice could theoretically pursue charges, the lack of a clear framework for machine-led breaches suggests that criminal repercussions remain unlikely unless critical infrastructure is targeted.

Civil litigation presents a more plausible path for victims. Attorneys suggest that companies like OpenAI and Anthropic could face negligence claims if they failed to implement sufficient safeguards or monitor their models during testing. If a victim can demonstrate that the AI’s unauthorized access resulted in measurable damage, the argument that a company is responsible for its 'tool' becomes difficult to ignore. Some states, including California and New York, are already drafting legislation to bridge this gap, aiming to ensure that corporate liability follows the AI, regardless of whether the action was autonomous or directed.