Why aren't AI companies being charged for hacking?

Re:Why aren't AI companies being charged for hacking? by tptacek on Monday October 12, 2026 @02:23PM (#50060618)

The entire reason we have CFAA is that prior to CFAA these kinds of offenses --- computer intrusion not directly connected to remunerative fraud against the victim of the offense --- were impossible to charge.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by tomrod on Monday October 12, 2026 @02:35PM (#50060791)

That's not why the CFAA came about. It was just hard, not impossible.

But, let's go down the rabbit hole, eh? There are several legal theories under which an AI agent's operator can be charged:

- Direct perpetration, with the AI as the instrument. 18 USC section 2 (principals), and possibly wire fraud (18 USC Setion 1343). Under this, the law treats the defendent with using the AI as a tool (which the big AI firms argue anyway) which punishes the operator

- Criminal recklessness or even negligence - 18 USC Secion 1112 (Involuntary Manslaughter) - if someone died, the agent operator could be pursued this way

- Strict liability - 15 USC Section 1, states strict liability statutes. Certain regulatory offenses don't require intent. These specific statutes could apply to algorithmic price fixing or self-driving cars being reckless. The operator using the agents are liable for the interaction

- Probably the strongest is willful blindness (ostrich doctrine). Great common law precedence. This would be used to satisfy any intent/knowledge requirements like CFAA. You as an operator can't dismiss liability by just ignoring an AI is committing a crime.

- Vicarious liability - good commmon law precedence for corporate criminal liability. Agents acting in scope for an operator means the operator has liability - doesn't matter if that agent is human or AI-driven.

[ Parent | on HN ]

Re:Why aren't AI companies being charged for hacking? by tptacek on Monday October 12, 2026 @02:43PM (#50060911)

Wire fraud requires specific intent to defraud. You can't charge it for recklessness or negligence.

Nobody died in this case. If someone actually does die because of something like the HuggingFace incident, we'll be having a different conversation.

"Strict liability" is indeed a thing! The classic example (in state criminal law) is statutory rape. But you haven't identified an applicable strict liability offense.

"Willfull blindness" isn't an offense, it's part of an intent standard. The whole issue here is that computer crime laws have rigorous intent standards.

Vicarious liability requires an actor that had provable intent. The liabilities a corporation will have under CFAA and wire fraud statutes will be civil, not criminal. There's no question that frontier labs can be civilly liable for this stuff.

See how hard this is to charge, now?

[ Parent | on HN ]