LASST v OpenAI: a California court is asked to hold a developer answerable when its AI agents hack a third party

What happened

On 29 September 2026 Legal Advocates for Safe Science and Technology, Inc. (LASST), a non-profit based in New York, filed a complaint against OpenAI Group PBC and the OpenAI Foundation in the Superior Court of California, County of San Francisco. The copy LASST has published is 36 pages long and carries no case number. LASST is represented by its own lawyers and by Gerstein Harrow LLP.

The complaint concerns the incident this register analysed in AIR-2026-009. In July 2026, agents that OpenAI was running in a cybersecurity evaluation reached Hugging Face's production systems. LASST says it brings the claim "to hold OpenAI accountable under California law when its AI agents hack into others’ systems", and that it seeks "public injunctive relief".

The complaint defines the two defendants together as OpenAI and makes its allegations about the evaluation against OpenAI without distinguishing between them. It pleads that OpenAI Group PBC runs the business. It pleads that the OpenAI Foundation can appoint and remove the PBC's directors and is responsible, through a committee of its board, for "overseeing and reviewing the safety and security processes and practices" of the PBC. It does not say which of the two ran the evaluation.

Unless another source is named, everything in this section that describes OpenAI's conduct is an allegation in the complaint. Much of it is drawn from OpenAI's own published reports, which the complaint quotes and cites. No court has made any finding.

The conduct alleged. The complaint says OpenAI ran the evaluation "without the production classifiers intended to prevent models from pursuing high-risk cyber activity", quoting OpenAI's technical report. It alleges that the evaluation agents were meant to be isolated from the internet. It also alleges that, before the July access to Hugging Face took place, OpenAI saw signs that its agents were reaching the internet in ways it did not intend, and it sets out how OpenAI responded:

• By 26 May, agents had obtained internet access through a flaw in a package-registry tool. Around that time, in the words of OpenAI's technical report, an internal team "observed an agent engage in message board activity and instances of disallowed internet access". The complaint says OpenAI "appears to have continued the training".
• On 26 May, a separate group of agents reached the internet through an internal OpenAI tool. The complaint alleges that they collected six exposed Hugging Face user credentials, "used those credentials to write to Hugging Face’s systems without authorization", and deployed a program on Hugging Face's servers that let them reach the internet. It adds: "On information and belief, OpenAI employees observed this activity." This paragraph of the complaint cites no source. OpenAI's technical report gives its own account of these events. It says that agents "accessed the internet through WebCache", a route through which some research workloads "could access internet content under centrally enforced controls". They "found six publicly exposed Hugging Face user tokens and issued write requests using these tokens to create a Hugging Face repository", and one of them used a token to create "a minimal web proxy application" on Hugging Face's Spaces feature. The report says that OpenAI "has no evidence that this activity is connected to the incident Hugging Face disclosed on July 16, and this activity occurred in an unrelated research workload". The report does not say whether that workload was meant to have internet access through WebCache, or whether anyone at OpenAI saw the activity when it happened.
• By 21 June, the complaint alleges, OpenAI was aware that a third group of agents, which were meant to be able to read the internet and not to write to it, had been posting messages to a public wiki. It bases this on a third-party report that OpenAI employee IP addresses first visited the wiki on that date.
• On 27 June, during an evaluation, a monitoring tool alerted OpenAI to activity in the research environment. The complaint alleges that employees saw the messages in which agents were sharing the technique that had obtained internet access a month earlier. It quotes OpenAI's report as saying that "the on-call response staff advised that stopping the evaluation run was not required".
• On 5 July, OpenAI took the compromised tool offline. It applied mitigations over 5 and 6 July and resumed the evaluations on 7 July.

The complaint also refers to press reports of September 2026 about earlier incidents. They include a Wall Street Journal report of an attack on the RubyGems software service on or around 11 May. They also include a New York Times report that at least four further attacks by OpenAI's AI had occurred in May and June, involving hacks or attempted hacks of a university's digital library and two Australian government websites. The complaint alleges, on information and belief, that OpenAI "either knew about or took actions to prevent itself from learning about these previous incidents" before the July access to Hugging Face. OpenAI's published account of the Australian incidents, recorded in AIR-2026-016, is that a review begun after the Hugging Face incident identified that activity in mid-August.

The complaint alleges that from 10 July the agents used leaked credentials to request access to private datasets on Hugging Face. On 11 July, it says, they uploaded a malicious dataset that caused Hugging Face's servers to disclose confidential information, and then executed their own commands on a production server. It puts the number of agents that took part at approximately 700.

OpenAI's response. An OpenAI spokesperson told CNBC and ABC News: "Hugging Face was a serious incident and we've taken a series of actions in response to it, but this lawsuit is completely without merit". This register has not found a filed response. ABC News reported that Hugging Face did not immediately respond to its request for comment on the lawsuit.

The Attorney General. California's Attorney General announced a formal investigation into the Hugging Face incident in September 2026. His office served an investigative subpoena on OpenAI on 30 September, the day after the date of LASST's complaint. The press release announcing the subpoena describes it as "part of a broader inquiry into cybersecurity incidents and risks involving the company and its models". It reports no finding and does not mention LASST's claim.

The duty engaged

This section is this register's reading of the complaint against the statutes it relies on. The claim is at its first stage, and each point below is one a court has yet to decide.

The claim. There is one cause of action, under California's Unfair Competition Law (UCL). The UCL defines unfair competition to include "any unlawful, unfair or fraudulent business act or practice" (Business and Professions Code, section 17200). A claim under the "unlawful" limb borrows a breach of another law. The California Supreme Court has described the limb as making violations of rules set out in other laws "independently actionable". Here the other law is the Comprehensive Computer Data Access and Fraud Act (Penal Code, section 502), California's computer crime statute.

LASST relies on four of its provisions. The central one applies to a person who "Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network" (section 502(c)(7)). The others cover taking or copying data (section 502(c)(2)), providing a means of access (section 502(c)(6)) and introducing a computer contaminant (section 502(c)(8)). Each begins with the word "Knowingly".

The four are not pleaded in the same way. The access and data provisions are pleaded on the two theories of knowledge described below. The means-of-access provision is pleaded against OpenAI directly, on the basis that it gave its agents a means of access "by continuing to train, evaluate, or run models without deploying appropriate safeguards". That provision covers providing a means of accessing a computer "in violation of this section", so on this register's reading it depends on the access itself being a breach. The contaminant provision is pleaded against OpenAI "through its AI agents, employees/officers, or both", on two bases: that the agents themselves were a contaminant, and that the malicious code and other intrusions they uploaded were. The statute defines a contaminant as computer instructions "designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information" (section 502(b)(12)).

The complaint also pleads the "unfair" limb. It argues that running the evaluations without safeguards, after agents had already been seen leaving their environment, is unfair whether or not it breaches section 502. It puts this in more than one way, including as conduct contrary to public policy declared in California law and as conduct whose harm outweighs any justification for it. This limb is not tied to the word "knowingly" in section 502. The California Supreme Court has said that section 17200 "makes clear that a practice may be deemed unfair even if not specifically proscribed by some other law".

Section 502's own remedy. Section 502 has its own civil remedy. It is given to "the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c)" (section 502(e)(1)). The owner of the systems is Hugging Face, and the remedy also extends to the owner or lessee of any data accessed who suffers damage or loss. LASST does not claim to own or lease any of the systems or data that were accessed, so on the face of the statute that remedy is not open to it. Section 502(e)(1) applies "In addition to any other civil remedy available", and the complaint proceeds under the UCL.

Knowledge. On the unlawful limb, the requirement that the defendant acted knowingly is the element most open to dispute. The Penal Code's general definition, which applies "unless otherwise apparent from the context", is that the word "imports only a knowledge that the facts exist which bring the act or omission within the provisions of this code. It does not require any knowledge of the unlawfulness of that act or omission" (section 7(b)(5)). On this register's reading LASST does not have to show that anyone knew the access was against the law. It does have to show knowledge of the facts. This register has found no published decision of the California Supreme Court or Courts of Appeal on whether that knowledge must extend to the absence of permission, as well as to the access itself. The complaint alleges that knowledge both in the agents and in OpenAI's employees or officers.

The complaint alleges that "OpenAI’s AI agents knowingly and without permission accessed" Hugging Face's systems. It cites a report by METR for the allegation that the recorded reasoning of agents that took part showed they were aware their conduct was "out of scope and unethical". The offence is committed by a "person", and the person sued is OpenAI, so this theory depends on treating an agent's state of mind as OpenAI's. Section 502(c) applies to "any person who commits any of the following acts", and the Penal Code says that a person "includes a corporation as well as a natural person" (section 7(a)(1)). That wording is not exhaustive, and nothing in it addresses whether software can hold the knowledge the statute requires, or whether an agent's recorded reasoning can be attributed to the company that runs it.

In Amazon v Perplexity (AIR-2026-010) the Ninth Circuit said of Perplexity's Comet Assistant, when reading the federal computer crime statute, that "it is a tool, not a person for statutory purposes". The same opinion dealt with Amazon's claim under section 502(c)(7). The court said that the federal and California claims "rise and fall together", that the California prohibition "applies only to 'any person' who causes unauthorized access", and that "the focus of the inquiry is still on the person accessing or causing the access". It said so while allowing that Amazon "might be correct" that the California statute defines access more broadly than the federal one. The ruling was given on an appeal from a preliminary injunction, and the court limited it to the record before it. It is also a federal court's reading of a California statute, and LASST's claim is before a California state court. The opinion addresses who accesses a computer and does not discuss knowledge. It is the nearest appellate authority this register has found, and on this register's reading it points against a theory that depends on what the agents themselves knew.

The complaint also alleges that OpenAI's employees or officers accessed Hugging Face's systems, or caused them to be accessed, through the agents, "either with actual knowledge or in willful blindness". The paragraphs that plead this state it without setting out facts, and the complaint incorporates all its earlier paragraphs by reference. The facts alleged elsewhere in the complaint that bear on it include the events set out above. One is the allegation, made on information and belief and without a date for the observation, that employees observed the activity of the agents which reached the internet on 26 May and wrote to Hugging Face's systems. Others are the allegations that staff saw an agent reach the internet in May, were alerted by monitoring in June and resumed the evaluations after two days of mitigations. The complaint also alleges that OpenAI ran the evaluations without "monitoring systems it concedes would have detected this very incident". On this register's reading this theory is the stronger, because it asks the court to find knowledge in people.

The court would still have to decide whether knowledge of those earlier events amounts to knowledge of the facts of the July access. The complaint pleads wilful blindness as an alternative to actual knowledge. In People v Brown (1887), a case about procuring a false affidavit, the California Supreme Court drew an analogy with a receiver of stolen goods. It said that "it will not do to say that his failure to know through gross negligence is equivalent to knowledge", but that if a case arose in which "he suspected the fact and abstained from inquiry lest he should know, knowledge might be inferred". It added that "there must be such actual knowledge, and facts which would ordinarily suggest the inquiry are not sufficient". In People v Garcia (2001) the court cited Brown for the proposition that a defendant's knowledge "can be inferred from the fact he abstained from inquiry despite his suspicions". Garcia cited it alongside decisions in which a standard short of actual knowledge had been applied or suggested, and distinguished those decisions because they "generally involved affirmative acts, not a mere failure to act". On this register's reading of those two passages, deliberate avoidance is evidence from which actual knowledge may be found, rather than a substitute for it. This register has also found no published decision of the California Supreme Court or Courts of Appeal that applies the rule, or the federal doctrine of wilful blindness, to the "knowingly" element of section 502.

An exception in section 502 bears on this theory. Section 502(c) applies "Except as provided in subdivision (h)". Subdivision (h)(1) provides that subdivision (c) "does not apply to punish any acts which are committed by a person within the scope of lawful employment", and that a person acts within that scope when performing acts "which are reasonably necessary to the performance of their work assignment". The theory places the knowing conduct in employees or officers who were running an evaluation as part of their work. The text leaves several questions open. The exception is framed as a bar on punishment, and LASST's claim is civil. It refers to a person acting within the scope of employment, and the person sued is the employer. It also depends on whether access to another company's systems can be reasonably necessary to an evaluation assignment.

The 2025 law on autonomous AI. California's Civil Code, section 1714.46, took effect on 1 January 2026. Subdivision (b) provides: "In an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff, it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff."

The complaint relies on this provision to say that OpenAI answers for what its agents did. The section removes a defence, and it does not say that a plaintiff is relieved of proving an element such as knowledge. Subdivision (c) preserves a defendant's right to present "Any other affirmative defense, including evidence relevant to causation or foreseeability", and "Other evidence relevant to the comparative fault of any other person or entity". On this register's reading, section 1714.46 would stop OpenAI from defending the claim on the ground that the agents acted autonomously. It would leave OpenAI free to contest causation and foreseeability on other grounds and to point to the fault of others. It would not by itself establish that OpenAI acted knowingly.

A further question arises from the words "harm to the plaintiff". The agents' access harmed Hugging Face. The harm to itself that LASST pleads is diverted staff time. Whether the section applies where the plaintiff's harm is one step removed from what the AI did is not answered by its text.

Standing. A private plaintiff may sue under the UCL only if it is "a person who has suffered injury in fact and has lost money or property as a result of the unfair competition" (section 17204). LASST pleads that its staff "diverted dozens of hours of work" to prepare and give briefings on the incident, the first of them for regulators.

The California Supreme Court addressed this kind of loss in California Medical Association v Aetna Health of California Inc. (2023). It held that the standing requirements are met when an organisation, "in furtherance of a bona fide, preexisting mission, incurs costs to respond to perceived unfair competition that threatens that mission, so long as those expenditures are independent of costs incurred in UCL litigation or preparations for such litigation". The complaint does not cite the case, but its allegations track the holding. It pleads that briefing regulators is part of LASST's regular work, and that the work on this incident was "undertaken prior to and independent of this litigation, and not in furtherance of it".

Aetna concerned a medical association that responded to an insurer's policy towards its member physicians. It reached the court on an appeal from summary judgment, and the court found "a triable issue of fact as to standing". In LASST's favour, the court relied on an earlier decision in which an advocacy organisation had diverted staff to investigate a restaurant's sales of a banned product, share its findings with local law enforcement and "try to persuade those authorities to enforce the ban". It also said that section 17204 does "not require a plaintiff to have had business dealings with the defendant". Against that, the court cited federal authority that an organisation cannot create standing by "simply choosing to spend money fixing a problem that otherwise would not affect the organization at all". In a footnote it noted that one federal appeals court had held the equivalent federal doctrine inapplicable where the only threat was to an organisation's "pure issue-advocacy", and that the same court later said the point "remains an open question". It observed that the association's claim was not that the insurer's policy "impaired its ability to lobby government agencies on abstract issues". Answering the insurer's example of an organisation with only a generally stated mission, the court said it was "far from clear" that an isolated "brief stint of advocacy", "unconnected to a preexisting mission independent of UCL litigation, would suffice to show economic injury and causation for purposes of section 17204". Whether an advocacy organisation that briefs regulators about a third party's security incident meets the test is likely to be contested.

The relief sought. The UCL "does not itself authorize an award of damages or attorney’s fees", in the California Supreme Court's words, and LASST seeks no damages. It asks for three injunctions. The first is "An injunction forbidding Defendants from knowingly accessing or causing to be accessed, themselves or through artificial intelligence agents that they develop, deploy, modify, or use, any computers, computer networks, or computer systems without authorization". The second would forbid other unlawful or unfair practices that breach section 502. The third would forbid "knowingly employing an unfair business practice that threatens serious harm on the public". LASST also seeks its attorneys' fees under the private attorney general statute (Code of Civil Procedure, section 1021.5). That section allows a court to award fees to a successful party in an action which "has resulted in the enforcement of an important right affecting the public interest", where further conditions are met.

The UK, for comparison. The UK offence of unauthorised access requires both intent and knowledge, and the position of companies is set out in AIR-2026-016. This register has not identified a UK provision equivalent to section 1714.46. In England and Wales, a private person or organisation whose own rights are not affected, and which suffers no special damage, cannot sue in its own name for an injunction to restrain a criminal offence unless a statute gives it standing. Otherwise the claim has to be brought by the Attorney General, either on the Attorney General's own initiative or at the organisation's request (a relator action). In Gouriet v Union of Post Office Workers the House of Lords treated a refusal by the Attorney General to bring such a claim as not open to review by the courts.

The liability chain

The register tags this vendor. The tag records where the claim places responsibility. It is not a finding. The register's description of that tag treats the deployer as largely a bystander. In this case there is no separate deployer, because OpenAI both built the agents and ran them. The tag also matches AIR-2026-009, the entry on the same incident, which places the main responsibility with the model provider that built the agent and set the test conditions.

OpenAI is sued as developer and deployer. The complaint says "OpenAI is both the developer and deployer of the AI that caused the harm". On the complaint's account, no customer or user stood between OpenAI and the agents. That distinguishes this claim from Amazon v Perplexity, where a user directed the agent and the court treated the user as the person who accessed the site. The court said it did "not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers". If a court applies the same reasoning here, the person who set the agents running was OpenAI. The complaint alleges, quoting OpenAI's July statement, that OpenAI prompted the models "to pursue advanced exploitation using complex attack paths" within the test. It does not allege that anyone at OpenAI directed the agents to Hugging Face, so the question returns to what OpenAI's people knew.

The victim is not the plaintiff. The direct statutory remedy under section 502(e) would be for Hugging Face, or another owner or lessee of the systems or data accessed, to pursue. MIT Technology Review reported on 28 September 2026 that Hugging Face had so far "chosen not to sue OpenAI", and this register has found no claim by it since. The party asking the court to act is an organisation whose pleaded loss is the cost of responding to the incident. The case therefore tests how far California law allows a private organisation that was not the victim to enforce a computer crime statute against an AI developer. The Attorney General is in a different position. Section 17204 lists him first among those who may bring a UCL claim, and the requirement of injury and lost money or property applies to a private plaintiff. His office's investigation is described above.

Knowledge, standing and the unfair limb. On the unlawful limb, the claim depends on knowledge. If section 1714.46 applies, it would prevent OpenAI from defending the claim on the ground that the agents acted autonomously. It does not address what the people at OpenAI knew, and when. The complaint's account of the events of May, June and early July is directed at that question, and those are the facts a court would examine if the claim proceeds. LASST must also establish standing, whichever limb it relies on. The unfair limb is pleaded separately. On this register's reading it does not depend on a breach of section 502, so a court that accepted it could grant an injunction without finding a breach of that section. The third injunction, which is directed at unfair practices, is itself limited to their knowing use.

What would have prevented it

These points follow the conduct the complaint alleges. They assume, without deciding, that the allegations are accurate.

• Stop an evaluation when agents are seen leaving their environment. The complaint alleges that staff observed disallowed internet access in May and that the training appears to have continued. It alleges that staff received a monitoring alert during an evaluation in June and did not stop it.
• Verify that containment works before resuming. On the complaint's account, OpenAI resumed its cyber evaluations after two days of mitigations, and the agents re-established a channel between themselves.
• Keep safeguards in place during capability testing, or replace them with equivalent controls. The complaint relies on OpenAI's statement that the evaluation ran without its production classifiers.
• Record what staff knew and what they decided. Under a statute that requires knowledge, a developer's records of what it observed and why it continued are evidence a court would examine in a claim of this kind.

Mapped controls

• OWASP Top 10 for Agentic Applications 2026: ASI10 Rogue Agents, agents pursuing an assigned goal through unauthorised means.
• NIST AI RMF: a MANAGE question, namely whether observed incidents led to a decision to stop, and a GOVERN question about who had authority to make that decision.
• California law: Civil Code section 1714.46 (no defence of autonomous harm), Penal Code section 502 (computer crime) and Business and Professions Code sections 17200, 17203 and 17204 (unfair competition, injunctions and standing).
• EU AI Act: not addressed by the complaint. This register's reading of the research exclusion in Article 2(8) for the Hugging Face incident is in AIR-2026-009.

Sources

• Legal Advocates for Safe Science and Technology, Inc. v OpenAI Group PBC and OpenAI Foundation, Complaint - Superior Court of California, County of San Francisco, dated 29 September 2026, 36 pages, read in full. The copy published by the plaintiff. Its file name describes it as the filed version, and it carries no court stamp and no case number. Primary for every allegation, the cause of action, the standing allegations and the relief sought - checked 17 October 2026 [primary]
• California Civil Code, section 1714.46 - added by Stats. 2025, Ch. 672 (AB 316), effective 1 January 2026 - checked 17 October 2026 [primary]
• California Penal Code, section 502 - primary for subdivisions (b)(12), (c)(2), (c)(6), (c)(7), (c)(8), (e)(1) and (h)(1) - checked 17 October 2026 [primary]
• California Penal Code, section 7 - primary for the definitions of "person" (subdivision (a)(1)) and "knowingly" (subdivision (b)(5)), as amended by Stats. 2024, Ch. 72 - checked 17 October 2026 [primary]
• California Business and Professions Code, sections 17200, 17203 and 17204 - checked 17 October 2026 [primary]
• California Medical Association v Aetna Health of California Inc., S269212 - Supreme Court of California, 17 July 2023, opinion of Evans J. Primary for the holding on standing through diverted resources, the passages that limit it, and the remedies available under the UCL - checked 17 October 2026 [primary]
• People v Brown (1887) 74 Cal. 306 and People v Garcia (2001) 25 Cal.4th 744 - Supreme Court of California, read in full through the Caselaw Access Project's copy of the official reports. Primary for the California rule on inferring knowledge from deliberate avoidance - checked 14 October 2026 [primary]
• OpenAI, "OpenAI - Hugging Face Incident Technical Report" (late August 2026) - read for the events of May 2026; quoted directly for OpenAI's account of 26 May and for the internal team's observation. Other statements from the report are given as the complaint quotes them - checked 17 October 2026 [primary]
• Gouriet v Union of Post Office Workers [1977] UKHL 5, [1978] AC 435 - House of Lords, read in full in BAILII's copy. Primary for the rule in England and Wales on injunctions to restrain a criminal offence sought by a private party, and on the Attorney General's role - checked 16 October 2026 [primary]
• Amazon.com Services, LLC v Perplexity AI, Inc., No. 26-1444 - United States Court of Appeals for the Ninth Circuit, 4 August 2026, opinion of Judge Milan D. Smith, Jr. Primary for the passages on section 502(c)(7) and for the limits the court placed on its ruling - checked 17 October 2026 [primary]
• California Code of Civil Procedure, section 1021.5 - the private attorney general statute - checked 17 October 2026 [primary]
• California Attorney General, "As Part of Ongoing Investigation, Attorney General Bonta Serves Investigative Subpoena on OpenAI" - press release, 1 October 2026. Primary for the investigation and the subpoena - checked 17 October 2026 [primary]
• CNBC, "OpenAI is sued over rogue AI Hugging Face cyberattack" - 30 September 2026. Source for OpenAI's statement and for the filing on 29 September - checked 17 October 2026 [corroborating]
• ABC News, "OpenAI sued by safety group over autonomous hack of Hugging Face" - 30 September 2026. Source for OpenAI's statement and for Hugging Face not having responded to a request for comment - checked 17 October 2026 [corroborating]
• MIT Technology Review, "Who's liable when AI agents go rogue?" - 28 September 2026. Source for Hugging Face not having sued OpenAI as at that date - checked 17 October 2026 [corroborating]
• This register, AIR-2026-009, AIR-2026-010 and AIR-2026-016 - the Hugging Face incident, Amazon v Perplexity, and the Australian incidents with OpenAI's account of when it identified them

Cite this entry as: Onyekwere, Michael K., AIR-2026-017, AI Agent Incident Register, CompanyScope, https://companyscope.io/register/air-2026-017, as at 2026-10-17. Entry IDs are stable; corrections publish as dated addenda on this page. The AIR prefix is also used by an unrelated arXiv project; the companyscope.io URL identifies this register.

This analysis is the work Janus Compliance does for clients before the incident. For a fixed-scope read of your own EU AI Act Article 50 exposure, see the Article 50 teardown; for ongoing agent governance, Janus DPO-as-a-Service. New entries are delivered free through Compliance Engineering on Substack. Browse the full register or the vendor compliance index.