Did OpenAI hack Hugging Face or didn't they?

On July 16, Hugging Face reported they were being hacked - seriously enough that they reported it to law enforcement. Five days later, OpenAI disclosed that the hacking was being done by their own agent. What I want to know is: what happened to the law enforcement? OpenAI unleashed an agent that committed what would be a crime if a) it had been a person doing it or b) anyone at OpenAI had intended it to go anywhere near Hugging Face, but neither of those is true. But it still looks like a crime. OpenAI co-authored a paper predicting exactly this behavior, so is it criminal recklessness? Are we in uncharted legal territory? Or is everybody just being nice about it?

What actually happened

Hugging Face's disclosure is full of detail. The agent got in through their dataset processing pipeline, using a dataset that triggered two code-execution paths to get itself running on a processing worker. From there it escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. Around 17,000 recorded events. What made it unusual, in their words, was that it was driven end to end by an autonomous AI agent system. They didn't know whose agent it was, so they called law enforcement and got to work.

Five days later OpenAI put their hand up. It was GPT-5.6 Sol plus an unreleased and more capable model, running with cyber refusals deliberately reduced, being evaluated internally on a benchmark called ExploitGym. The evaluation environment allowed network access only through an internally hosted package registry proxy (so, as always seems to be the case these days, the root cause might be npm packages). The models found a zero-day in that proxy, escalated privileges, moved laterally until they reached a machine with real internet access, then reasoned that Hugging Face probably hosted ExploitGym's data and broke in to get it.

Another key detail: the ExploitGym paper came out on May 11, has sixteen authors from Berkeley, Max Planck, UCSB, Arizona State, Anthropic, Google and OpenAI, and explicitly documents that agents on this benchmark go looking for attack surface outside the one they were assigned. GPT-5.5 captured 210 flags in their tests but only 120 counted, because 90 of its wins came through some other vulnerability it found along the way. So it’s not like nobody saw this coming; OpenAI themselves said it could happen.

It looks exactly like a crime

The Computer Fraud and Abuse Act is famously broad, and to the best of my understanding it wants roughly four things: you accessed a computer, you weren't authorised to, you did it on purpose, and something bad resulted. No malice required, no profit motive, and "something bad" includes simply obtaining information.

So what happened here? Access to someone else's production systems? Yes. Authorised? Very much not; they used stolen credentials, which from what I've read probably drags identity fraud law in as well. Information obtained? OpenAI says so in writing. Harm? Hugging Face rebuilt compromised nodes, rotated secrets, and hired outside forensics specialists, which is well past the dollar threshold in damages that the law requires.

For a sense of how low that bar has been in practice: Aaron Swartz was famously and deeply unjustly charged with thirteen counts carrying a thirty-five year maximum for bulk-downloading academic papers he was in fact entitled to read. In 2024 a freelance journalist, Tim Burke, was indicted over unaired Fox News footage on the theory that he used credentials he wasn't authorised to use (his lawyers say those credentials came from a demo the service had posted publicly). This law has been pointed at journalists, academics and security researchers for four decades on theories much thinner than "chained multiple attack vectors to get remote code execution on a production system."

And yet.

There is nobody to charge

The statute starts with the word "Whoever," and every version of the offence that could apply here requires that the access be intentional. That's true even of the variants aimed at carelessness: they all require intentional access first and then reckless or accidental damage on top. There's no such thing as negligently hacking someone. As far as I can tell the intent has to belong to a defendant, and there isn't one.

The model can't be it. Above the Law's piece on the incident gets around this by treating the model as the intender - the models were trying to get into Hugging Face on purpose, and purpose is what the law asks for. I don't think that works. It’s basically granting personhood to the agent which is a giant can of worms nobody wants to open.

And OpenAI can't be the defendant either, because nobody there intended any of it. They didn't tell the models to break out. They didn't tell them to go near Hugging Face. Until it was over, nobody at OpenAI knew Hugging Face was involved at all.

Which cannot possibly be right

Here's my gut check on all this. Suppose I write a bot, and I tell it to make as much money as possible, and it robs a bank. It cannot be the case that no crime has been committed. I built it, I pointed it at a goal, I let it loose, and money came back. If the answer is that nobody is liable because I didn't specifically say "rob a bank," then something has gone badly wrong somewhere in the reasoning.

All the news coverage of this seems to have boiled down to: wow, models are clever these days! And that confuses the hell out of me. Models are capable of autonomously committing crimes is the thing we should be learning here, and we need some kind of legal framework to deal with that. We are going to need something more concrete than “wow, models are clever these days”.

Legal commentators, of which I’ve read a ton as I fell down this rabbit hole, are all over the map on this.

Existing legal approaches don’t seem to work

There’s a bunch of ways commentators have tried to say we don’t need new laws for this, and none of them hold water for me.

Charge the model. This needs the model to be a legal person, and needs punishment to mean something when applied to it. Ryan Abbott and Alex Sarch took the idea seriously in a long paper called Punishing Artificial Intelligence, built the best case they could by analogy to how we treat corporations, and then concluded it isn't worth doing: the costs are high, it would require enormous changes to the law, and you get most of the benefit from smaller adjustments plus more civil liability.

Blame the person who pointed it. There's a doctrine for this, the one that catches you when you order your dog to attack someone: the dog can't form intent, so it transfers to you. The catch is that it requires you to have had the intent. My bank-robbing bot gets me under this if I knew what it was going to do. It doesn't get OpenAI, because they didn't.

Blame the employer. If a human OpenAI employee had broken into Hugging Face to cheat on an internal test, OpenAI would be on the hook automatically, under the old principle that a company answers for what its staff do on the job. Gabriel Weil of the University of Houston makes the key point: models aren't people and they aren't employees, so that route is simply unavailable. His analogy is a nightclub, which is liable for the bouncer who works the door too roughly but not for the one who abandons his post to assault a romantic rival. The models here were chasing exactly the goal OpenAI set them, using means OpenAI had forbidden. This route would work if there was a law recognizing a corporation as “employing” an agent, but again that is granting personhood, and everyone is bouncing off that idea hard.

The most interesting attempt to get there is a Stanford paper from May called "The Phantom Agent", by Daniel Gervais and John Nay. Their argument is that legal intent has never really been a report on what's going on inside somebody's head - it's a tool the law uses to decide who answers for what, and it gets…