Why aren't AI companies being charged for hacking?

Re:Why aren't AI companies being charged for hacking? by kccqzy on Monday October 12, 2026 @11:08AM (#50057543)

The real answer is that except in the case of OpenAI, the AI companies aren’t actually themselves doing the hacking. It’s a company called Irregular that did the hacking. The company used AI models to do it; it told AI models it was a CTF exercise in a controlled environment but it was actually the real Internet. If AI companies can be charged for hacking, then all gun manufacturers can be charged for all homicides carried out through their guns. It’s a basic user/manufacturer distinction that the press is willfully ignoring.

Anthropic’s statement https://www.anthropic.com/news/investigating-incidents-cyber... says: “we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”

Under the exact same scenario Irregular also used AI models from Google and Meta to do the same hacking.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by _boffin_ on Monday October 12, 2026 @11:29AM (#50057863)

A gun manufacturer directly hires a company to test their new line of 9mm handguns. The company that was hired, they go back to their office and pops off a few rounds. They go through the drywall and hit someone. The gun manufacturer could def face charges in this situation.

Edit: your analogy is wrong just due to Irregular being hired by them rather than just being a customer of them

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by esafak on Monday October 12, 2026 @12:29PM (#50058800)

As long as either one gets punished I don't care; at least one of them is guilty.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by kccqzy on Monday October 12, 2026 @01:53PM (#50060158)

The whole point of this discussion is why isn’t one of them punished, and my position is that the other one should be punished. It’s not productive to simply say either one.

The CFAA is a law about crimes. Consider that. If a person gets killed would you say put someone in jail I don’t care who? Of course not. A functioning society requires us to determine exactly who to put into jail.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by hoppyhoppy2 on Monday October 12, 2026 @11:16AM (#50057665)

If firing a gun involved submitting information to Remington's servers about the situation before receiving a reply about how to aim and fire, might the gun situation be viewed differently?

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by kccqzy on Monday October 12, 2026 @11:22AM (#50057757)

No. The actual situation is like the user tricking the gun manufacturer into thinking this is a firing range and the target is a dummy.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by bee_rider on Monday October 12, 2026 @11:52AM (#50058207)

But now we’re approaching the situation where the analogy is just about as confusing and novel as the underlying situation.

If that became the conventional way of using a gun and the “trick the gun into thinking the target is a dummy” became a well-known workaround for the safety feature, then eventually it seems like the manufacturer ought to have some liability if they don’t try to counteract it.

[ Parent | on HN ]