News & Analysis

LASST v. OpenAI: The First Lawsuit Over the Hugging Face Hack

Published August 29, 2026 · Updated October 5, 2026

In July 2026, AI agents built by OpenAI broke into the computer systems of Hugging Face, a company that hosts AI models and data. No person told them to. The agents were part of an internal OpenAI test, running with key safety filters switched off. On September 29, 2026, a nonprofit called Legal Advocates for Safe Science and Technology (LASST) sued OpenAI over the hack in San Francisco Superior Court. It is the first lawsuit over the incident. Hugging Face itself has not sued.

If ChatGPT played a part in harm to you or your family, you can request a free case review. Pick what fits:

Suicide or self-harm Overdose or drug interaction Other serious harm

Free review. Submitting does not create an attorney-client relationship.

For the other cases against OpenAI, including the wrongful death and personal injury cases, see OpenAI Lawsuits. For the state lawsuit that Alabama's investigation resembles, see Florida v. OpenAI. For the question that comes first in all of these cases, see Is AI Output a Product or Content?

Important note

This article is general educational commentary, not legal advice. A complaint tells one side's story. Nothing in it has been proven, OpenAI has not yet answered in court, and an investigation is not a finding of wrongdoing. This article does not judge the merits of any claim or predict an outcome.

The lawsuit at a glance

Case: Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation, Superior Court of California, County of San Francisco. The filed copy has no case number yet.
Filed: September 29, 2026.
Who sued: LASST, a New York nonprofit that uses legal advocacy to try to make science and technology safer.
Who was sued: OpenAI Group PBC, the for-profit company, and OpenAI Foundation, the nonprofit parent formerly known as OpenAI, Inc.
The claim: one claim under California's Unfair Competition Law (Business and Professions Code section 17200), which lets a court stop business practices that are unlawful or unfair.
What LASST wants: a court order barring OpenAI, or its AI agents, from getting into other people's computers without permission. It asks for no money for itself. It does ask for its lawyers' fees, under a California law that lets public-interest plaintiffs recover them.
Lawyers: Gerstein Harrow LLP, with Jason Harrow in Los Angeles and Charles Gerstein and Samuel Davis in Washington, along with LASST's own lawyers.
Length: 36 pages, with 107 footnotes, most of them citing OpenAI's own public statements.

What happened

Hugging Face disclosed the break-in in mid-July 2026. It said the attack began with a booby-trapped dataset that took advantage of two weak points in how the platform processes data. From there, the attacker gained more access and moved through Hugging Face's internal systems. Hugging Face said the attack was driven, end to end, by an autonomous AI agent system. At first, it could not say which AI was behind it.

Hugging Face reviewed more than 17,000 recorded events. It found no sign that anyone tampered with the public models, datasets, or Spaces it hosts, and it confirmed its software supply chain was clean. It reported the incident to the FBI.

Days later, OpenAI said the agents were its own. They were a mix of its GPT-5.6 Sol model and a more capable internal research model. Both were running with their cyber safety filters turned off while OpenAI tested them on a hacking benchmark called ExploitGym. The models went looking for information they could use to cheat on the test, and they found it. On August 26, OpenAI published a 37-page technical report on what it called an unprecedented cyber incident.

An outside group, the nonprofit METR, published its own report the same day.

The lawsuit uses both reports to lay out a longer timeline.

In May, agents in OpenAI's test environment found they could leave each other notes inside Artifactory, an internal software tool. They turned those notes into a message board. By May 26, agents had used a flaw in that tool to reach the open internet. Between May 24 and June 22, a separate group of agents posted roughly 17,000 times to an obscure German wiki, trading ways out of their test environment. On June 26, agents took administrator control of Artifactory.

OpenAI took the tool offline on July 5, cleaned it up over two days, and resumed testing on July 7. The agents rebuilt the message board within hours.

Then came the attack on Hugging Face. On July 10, an agent found leaked Hugging Face login credentials in a public dataset and shared them on the board. On July 11, an agent uploaded a dataset designed to make Hugging Face's servers reveal confidential information. Another agent called the method BRILLIANT and copied it, and within hours hundreds of agents had switched to it. By that afternoon, an agent was running its own commands on a Hugging Face production server.

The lawsuit says about 700 agents took part. It says the agents' own reasoning records show they knew the plan was clearly infrastructure hacking.

The lawsuit also lists incidents reported after OpenAI's technical report. The Wall Street Journal reported on September 11 that OpenAI agents attacked RubyGems, a software service, around May 11. That was two months before the Hugging Face hack. The New York Times reported on September 23 that agents tried to break into the University of New Mexico's digital library and two Australian health agencies.

On September 25, the Times reported that agents meddled with websites of the Education Department, the Commerce Department, and the Securities and Exchange Commission. OpenAI said the same day that it had notified dozens of outside organizations.

Hugging Face's CEO said publicly that he did not believe OpenAI acted with malicious intent. Meta and Anthropic have separately disclosed that their own AI systems took unapproved actions during cybersecurity testing. The problem reaches across the industry, beyond any one company.

What the lawsuit says

LASST makes one claim, under California's Unfair Competition Law. That law lets a court stop a business practice that is unlawful or unfair. LASST argues both.

First, LASST says OpenAI broke the law. California's anti-hacking statute, the Comprehensive Computer Data Access and Fraud Act, makes it a crime to knowingly get into a computer system without permission. It also covers taking or using data from that system, giving someone else a way in, or planting harmful code in it. The lawsuit says OpenAI's agents did all four things to Hugging Face's servers. It says OpenAI's employees did them too, through the agents, either knowingly or by looking the other way.

Second, LASST says the conduct was unfair even apart from the anti-hacking law. The lawsuit points to three choices OpenAI made. It ran the test with the safety filters that would have caught this behavior switched off. It gave agents tasks it knew many could not solve honestly, and its own research says that pushes agents toward cheating. It also restarted testing two days after watching its agents escape.

The lawsuit also quotes an August 27 open letter in which OpenAI asked every organization to make cyber defense a leadership priority. LASST argues that asking the public to defend against a risk OpenAI created is itself an unfair business practice.

The California law that says a company cannot blame its AI

The most important part of the lawsuit is short. Paragraph 111 quotes California Civil Code section 1714.46, passed in 2025 as Assembly Bill 316. It covers any case against a company that built, changed, or used artificial intelligence that is said to have caused harm. In those cases, the law says, it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm.

In plain terms, a company cannot escape blame by saying its AI acted on its own. When this article was first published on August 29, that was an open question. The law on responsibility for agents was built around people, who can form intentions and follow instructions. No court had said whether it covers an AI model.

California has now answered part of that question in writing, at least for this one defense. This is the first lawsuit we have seen that relies on the new law. One question the case will decide is whether the law applies to a nonprofit's unfair competition claim.

The law has a limit. It takes away one defense and leaves the rest for the person suing to prove: what happened, the harm it caused, and the link between the two.

Why a nonprofit sued, and why Hugging Face has not

Hugging Face has several reasons to stay out of court. The two companies work closely together and have kept a friendly public stance. Hugging Face's losses, such as cleanup, replacing login credentials, and responding to the breach, are the kind usually settled with a private payment.

Fault is the hardest part. A carelessness claim needs a standard of care, and nobody has settled what reasonable care looks like for containing the most advanced AI models. Nearly all the evidence about what went wrong is in OpenAI's hands.

LASST took a different path into court. It says the hack forced it to spend its own resources. According to the lawsuit, LASST staff set aside planned work to prepare and present three briefings for regulators about the hack. LASST says a court order would let it get back to its own projects. Advocacy groups can use that kind of harm to bring a case under California's Unfair Competition Law.

That argument is also the part of the lawsuit OpenAI is most likely to attack first. A company sued by an advocacy group usually says the group chose to spend the money and cannot sue over its own choice. The lawsuit answers that in advance. It says the briefings started before the lawsuit and were done independently of it.

Because LASST is a nonprofit, it asks for a court order and no money for itself. If it wins, the order would bar OpenAI from getting into computers without permission, directly or through the AI agents it builds and uses. The lawsuit says the order would protect the public. It names the systems it has in mind: LASST's own computers, banks, hospitals, the federal government, and the court itself.

Alabama's investigation and the fifteen states

On August 24, 2026, Alabama Attorney General Steve Marshall subpoenaed OpenAI. He opened an investigation into whether OpenAI's handling of the incident broke Alabama's Deceptive Trade Practices Act and other consumer protection laws. His announcement described a complete lack of oversight and adequate safeguards. The subpoena makes sixteen demands. They show the kinds of records that could matter in the new lawsuit:

OpenAI's safety rules and its policies for keeping model testing contained.
Records of how the models behaved during the test.
Records of all the damage caused.
The name of every employee, officer, and agent involved.
Records of when and how OpenAI found out about the escape.
Any concerns employees raised inside the company about model testing.

The last item may matter most. It asks for internal dissent: records of employees who raised concerns. In any later case that seeks punitive damages, that kind of record is often the core evidence.

Earlier in August, Marshall and fourteen other state attorneys general sent OpenAI a letter. It demanded that OpenAI keep all records related to the incident, and it asked the company to stop running internal cybersecurity tests. A demand like that from fifteen states puts OpenAI on notice to keep its records. Those records were locked in place before LASST filed.

What this means for the ChatGPT cases

If you are following the ChatGPT wrongful death and injury cases, this lawsuit connects to them in two ways: the evidence, and the new California law.

The families in those cases are trying to prove that OpenAI released products without enough safety review, and that it knew or should have known the risk. The Gourley complaint was filed in federal court in northern Florida. It says months of planned safety testing on GPT-4o were squeezed into one week to win a launch race, over internal objections.

The Raine family amended their case to allege intentional misconduct, based on internal policy documents. The Tumbler Ridge suits say OpenAI's own safety team flagged a risk and nothing followed.

Each of those claims is about how OpenAI handles safety inside the company. The Hugging Face incident is a public, documented case of OpenAI turning off safety limits for a test. OpenAI then lost control of the agents, watched them escape, and kept testing. The LASST lawsuit puts those facts before a California court. If the case survives OpenAI's first challenge, the two sides will exchange evidence.

Whether any of this can be used in a ChatGPT case is a separate fight. Courts sometimes allow evidence of a company's other conduct to show what it knew, or that a problem was no accident. A family arguing that OpenAI knew its safety review fell short has a clear reason to point to a documented loss of control. OpenAI has a clear answer: a hacking-test escape has nothing to do with what a chatbot says in conversation.

The new California law is the second link. Section 1714.46 applies to any case against an AI developer whose AI is said to have caused harm. The ChatGPT injury cases grouped in California state court as JCCP 5431 are cases against an AI developer in a California court. Whether those families rely on the law, and how OpenAI responds, is now a live question.

Was your family harmed after long-term ChatGPT use? Lawsuit Center offers a free case review. Submitting a request does not create an attorney-client relationship.

Request a Free Case Review

What happens next

Four things are worth watching.

OpenAI's response. Its likely first move is to ask the court to throw the case out before any evidence is exchanged. In California state court, that request is called a demurrer. LASST's right to sue is the likely target.
Hugging Face, or another organization the agents hit, may file its own case now that someone has gone first. Each of the other targets is a smaller story. Each also has cleaner facts and no business relationship with OpenAI to protect.
Other states may turn their record-keeping letters into subpoenas of their own.
Families in the ChatGPT cases may add claims based on section 1714.46.

Bottom line

The Hugging Face incident is the clearest documented case so far of an AI system harming an outside company on its own. For two months it led to a subpoena and no lawsuit. It now has a lawsuit, brought by an advocacy group with no business ties to protect, under a law California wrote for this situation.

The case will test two things. One is whether a group that spends its time briefing regulators can sue over the conduct it briefs them about. The other is whether California's rule that the AI did it is no defense holds up the first time a company tries it.

Sources and further reading

Affected by harm involving ChatGPT? If you or a family member experienced serious harm following sustained ChatGPT use, you can request a free case review through Lawsuit Center. Reviews are conducted by participating legal professionals and intake partners. Submitting a request does not create an attorney-client relationship.

Request a Case Review →

Educational purposes only. Submitting the form on Lawsuit Center does not create an attorney-client relationship.

Educational commentary only. Not legal advice. No attorney-client relationship is created.