HN

Comments (286)

• Menu

  akagusu
  The answer to this question is very simple, and yet extremely unconfortable: the law is for common people, not for the elite.The elite is permited to do whatever they want without consequences. Consequences are for common people, so they can behave the way elite want.
• Menu

  stickfigure
  The real answer is that crime generally requires mens rea. At some point, however, letting your AI break into other systems will be conventionally understood as an act of negligence, and it will get prosecuted accordingly. We're not at that point yet.
• Menu

  dccoolgai
  In case you were wondering why Anthropic last week banned "verbally abusive" language towards its agents: this is 100 percent why. Because if they get you to believe - even a little bit - that their platform is "sentient" it means _they_ aren't as liable for criminal consequences.
• JohnMakin
  I don't know if legal "intent" is as black and white as this is making it sound:> AI companies are however claiming the undesired activity, such as hacking foreign government websites, is not part of the design, but part of the unpredictable part of the system. That tries to remove the intent which would in turn remove the criminality of the activity.In California at least, a DUI resulting in a fatality, if it is a second offense, often carries murder charges and they do convict quite frequently. The argument is the training and education you receive after the first DUI informs you enough to know the action of driving a vehicle impaired could result in serious harm to someone else, and that establishes enough intent legally for a murder charge. There are lots of areas of the law like this.It can be easily assumed that Anthropic/OpenAI et al know their technology is dangerous - they use it as a marketing angle constantly. So, if you deploy technology you know is dangerous, and it causes harm, that should be more than enough legally if not civilly.Of course this is all burying the lede a little bit, the real answer is, at least in the United States, the law does not apply the same way to the wealthy/powerful as it does you or I.
• Menu

  cracell
  Are any victims calling for prosecution?It’d be a waste of tax payer money. The companies who were hacked are just directly receiving restitution behind closed doors. Unless they are unhappy there’s no reason to bring the courts into it.I completely agree that proper safeguards were not in place. But response is happening just not in public. Companies work problems out between their own lawyers all the time because it’s much cheaper, faster and easier to control the PR around.
• Menu

  thelastgallon
  The more important question is the government went after Aaron Schwartz, United States v. Aaron Swartz after JSTOR settled with him.AI companies stole everyone’s work and they sell it! Where are United States, Carmen Ortiz, etc?
• Menu

  kccqzy
  The real answer is that except in the case of OpenAI, the AI companies aren’t actually themselves doing the hacking. It’s a company called Irregular that did the hacking. The company used AI models to do it; it told AI models it was a CTF exercise in a controlled environment but it was actually the real Internet. If AI companies can be charged for hacking, then all gun manufacturers can be charged for all homicides carried out through their guns. It’s a basic user/manufacturer distinction that the press is willfully ignoring.Anthropic’s statement https://www.anthropic.com/news/investigating-incidents-cyber... says: “we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”Under the exact same scenario Irregular also used AI models from Google and Meta to do the same hacking.
• Menu

  weddpros
  HackerNews doesn't get charged for DoS'ing under-provisioned web servers either. As others have said, there must be a line between hack attempts and accidents.
• Menu

  tptacek
  The argument laid out in this post very definitely is not how "intent" works in US criminal law. Under CFAA, they had to have wanted to break into the systems that were attacked; it is not enough to demonstrate that they built a system recklessly.
• Menu

  aceazzameen
  AI companies won't be charged for anything because they're the primary growth engine of the current economy.I think they should be charged, but they won't.
• prepend
  I wondered the same thing. If OpenAI instructed employees to accomplish a task no matter what and they hacked, they would be investigated. Maybe not convicted, but investigates and charged.Intent is important, but having a lax environment that leads to this is still a crime. See the lawsuits about sexual harassment where the company didn’t have the intent to assault people.
• advael
  I think these companies very much want to assign responsibility to an entity we can't meaningfully jail or fine. I think it may sometimes make sense to claim model provider negligence instead of operator responsibility, and user intent can likely be easily ascertained by reading the conversation logs. In a case where a company used its own model, responsibility is obviously and unambiguously within the company, of course.
• Menu

  tonmoy
  If I tell an agent to trade stocks and maximize profits but the agent decides to hack something to achieve that am I on the hook for hacking? Genuine question
• Menu

  augment_me
  The juridical process is not caught up with this technology yet.You have OpenAI, launching a process, which is handled through an external RL-environment company which then launches a subprocess that ends up hacking somewhere. If there are consequences at any point for this, you can input another shell company, and then another third party, etc, until it's impossible to assign responsibility
• Menu

  k310
  Because the president is heavily invested in them, in violation of the emoluments clause.[0]> The Domestic Emoluments Clause (aka the Presidential Emoluments Clause) (art. II, § 1, cl. 7)[0] https://www.congress.gov/crs_external_products/IF/PDF/IF1108...
• Menu

  anonyfox
  At some point its making a butterfly responsible of the butterfly effect. I get the sentimentm but reasonably somewhere the line should be drawn where accidents can happen, especially noncritical stuff like these "hacks" that don't even deserve the word.
• Menu

  dspillett
  Aside from the diffusion of responsibility thing, most governments aren't going to push for prosecution because they are all at least a little scared of AI investment not coming into their country. Many see getting left behind as an existential threat, one that is worth letting a few other things go in order to avoid.
• Menu

  pluc
  For the same reasons they aren't being charged for massive theft.
• nbulka
  What are the similarities and differences with something like the BP oil spill? Were people charged for that? Corporations are the closest analogue we have to cancer, unfortunately. They grow at all costs and forget their humanity.
• gertrunde
  I'd hope that the offenders in these incidents would pay off the victims in such a way that everyone walks away happy (or happy-ish).But I suspect that's probably a hope somewhat in vain.
• altruios
  National security issues. That's the core of why. Any hot water these AI companies will get into will be bailed out by the USA. The Arm's race has switched from Nukes, to AI and drones.
• SMAAART
  I wonder what the statute of limitations is.
• Menu

  bluejay2387
  If I took Metasploit and hooked it to a Cron job then used it to hack HuggingFace they would lock me away for life and the Justice Department wouldn't care that I use software to automate it. No idea why these companies get away with what is essentially the same thing.
• Menu

  jchook
  Related: Aaron Swartz (RSS, Creative Commons, Reddit, Markdown) was charged with unauthorized computer access and pirating copyrighted academic articles.They threw the book at him. He was charged and faced a maximum of 50 years in prison.OpenAI committed very similar crimes on a much larger scale, yet the most they will see is civil litigation.Insiders have called it the largest theft of labor ever in history[1].In the USA, corporations enjoy constitutional protections, the right to free speech etc, yet they are rarely if ever charged with crimes. For examples, see how the courts handle:* large scale systematic wage theft by corporations vs petty theft by an individual,* negligence infecting a 10k Americans with HIV by selling known-to-be-contaminated blood products (Bayer)1. https://arstechnica.com/tech-policy/2026/09/microsoft-exec-c...
• lossolo
  If you get hacked in the US, do you have to take legal action yourself, or does the government automatically investigate?
• Menu

  Noe2097
  Is it because nobody knows "how" to actually do it?
• Menu

  gslepak
  Same reason nobody was prosecuted for the murder of Suchir Balaji. Whole system is corrupt. Progress in AI is considered more important than both the law and human life.
• Menu

  criddell
  How many of the victim companies have filed complaints with the FBI? As I understand it, that would be step one.
• hackingonempty
  The article doesn't mention it but in the USA it may be because the Department of Justice has lost a lot of talent and the ones left are busy going after Trump's enemies and negotiating the other side in Trump's own lawsuit against the USA for Trump's family to be immune from IRS audits and arranging for multi-billion dollar compensation funds for Trump's henchmen.
• Menu

  sebzim4500
  I doubt this will catch on outside of luddite/cynical circles unless one of these attacks does some actual damage.Ignoring this, I would have appreciated more examples of what it would take for an act to lack intent. Because the definition of intent used in this article sounds so broad as to cover basically anything that ever happens.Accidentally run someone over? Clearly you knew that was a risk when you started driving, you should have been more careful. Intent.
• Menu

  est
  I had a similar question regarding driver-less EVs.In many countries driving license have some kind of demerit points system. How do you punish an AI?I recently learned that Baidu Apollo Go, each EV had a real human sitting behind a monitor supervising a fleet remotely.If there's traffic violation, some guy's license gets a ticket.
• lutusp
  > ... It’s a position tailored to dissuade prosecution as it removes intent, which is typically required for a crime.Don't forget negligence. Much of criminal law hinges on failing an implied or explicit responsibility. Negligence would propel a prosecution in many similar contexts, but AI is so new that little prior case law exists. Oh, and IANAL.
• wavefunction
  AI offers an attractive "diffusion of responsibility" to operators allowing them to point to AI as the culprit of the heinous acts not the people who profit from the AI, incidentally.
• jgalt212
  I'd be keen to see if there were any single user "experiments" that morphed into a hacking incident, and if so, was the person responsible with with unauthorized access charges. If so, then it will be yet another example of might makes right.
• Menu

  jonathanstrange
  They're US companies and I've heard that it requires intent according to US penal law. I find the article's claim that intent is established dubious. Since this is hard to prove without a whistleblower, it seems that they only have to fear civil lawsuits, and given that we speak of trillion+ USD companies they might feel confident to be able to fend these off or simply pay out the victims in settlements.
• Menu

  Invictus0
  Bringing charges is at the discretion of the prosecutor, and the CEOs of these companies are dining with the president. Learn a little bit about how power works.
• Menu

  zzzeek
  lawyers are helpless babies when an entirely first year legal question is wrapped up in...."technology". unfortunately(former IT support worker at a big famous law firm 30 years ago)
• vrganj
  Because government and corporate interest have merged at this point.
• Menu

  scotty79
  > If we can show that the design would foreseeably lead to the questionable activity, then we have shown that was the intent of its creators.That's a huge stretch. By that measure kitchen knife companies have intent for people to get murdered.
• 28304283409234
  Because the rich dont pay. They get paid. Dummy.
• Menu

  ltbarcly3
  1. While a crime, hacking isn't going to be charged unless the entity being hacked wants there to be charges, as a conviction will heavily depend on participation by that entity.2. Due to (1), hacking is almost always only charged against people without deep pockets, as why would you demand the FBI go after Anthropic when they will just pay you a stack of cash, tax free, today, to forgive them.The arguments here around intent are (potentially) irrelevant. Case law is clear that setting up a situation which foreseeably highly likely to produce an outcome (gross negligence) is (more or less and it's not quite this simple and varies by offense) equivalent to intent. In fact, automating something is often treated more harshly under the law than just doing it yourself.United States v. Morris (1991)Robert Morris released a self-propagating computer worm that caused widespread disruption. The Second Circuit upheld his conviction under the Computer Fraud and Abuse Act even though the government hadn't proven that he intended the resulting damage.People v. Ceballos (1974)Ceballos rigged a rifle booby trap to fire if someone opened his garage door. The California Supreme Court reviewed the principle that someone who installs a dangerous mechanical device may be held responsible for its consequences as though they had personally inflicted the injury. Ceballos was convicted of assault with a deadly weapon, and the California Supreme Court unanimously upheld his conviction in 1974.Something notable is that if Ceballos had fired the rifle himself, it is unlikely he could would have been prosecuted (due to self defense and the castle doctrine).As a prosecutor I would argue that setting AI agents loose without sufficient safeguards is gross negligence and/or willful blindness as they are well known to escape.
• Menu

  jstummbillig
  > Consequences so far: none.What?
• jorblumesea
  same story with IP theft, why is it ok for them to train on published author works? the answer is: there's money and wealth in play that is fine with it.
• josefritzishere
  [dead]
• jheriko
  [dead]
• drcode
  Don't you all understand that existing laws on the books are already adequate for dealing with the threat posed by AI/s
• Menu

  rfgplk
  I understand that people are upset by this, and I would be too, but if companies just built secure systems hacking couldn't be possible. And I'm not victim blaming, just pointing out the obvious.
• notfried
  No one with real money or power wants to cross OpenAI or Anthropic just yet. It's a closed ecosystem. OpenAI hacks HuggingFace, Nvidia soon after buys HuggingFace while it also before backed OpenAI. In the end, they just handle it all behind closed doors like family business.