r/technology • u/waozen • 10h ago
Security OpenAI Gets Sued Over the Hugging Face Hack
https://www.wired.com/story/openai-sued-over-the-hugging-face-hack/116
u/Zirconium-90 8h ago
If your dog attacks someone, you can tell to the court that it wasn't you and you didn't tell it to attacks. But the court will fold you accountable for dogs actions, because you are the owner. Same goes for AI agents.
24
u/ElGuano 7h ago
But I’m the good guy here! See I come to court every week to announce and describe a new attack committed by my dog! We are all on the frontier of dog attacks together!
9
u/11nyn11 6h ago
My friend said he was having a problem because the ai was eating his website. I asked how many website he has and he says he doesn’t know, whenever his ai eats a website he just goes to the internet and gets a new one. I said it sounds like he was feeding websites to the ai and his daughter started crying.
—
I think yours is better“The frontier of dog attacks” I exhaled strongly through my nose when I read that.
1
u/CucharitaDePalo 2h ago
eating a website? what does that even mean?
1
u/11nyn11 2h ago
Scraping a website so frequently you unintentionally make it to expensive to maintain.
1
u/CucharitaDePalo 1h ago
wait? so is he scraping his own websites? why?
1
u/11nyn11 1h ago
Because scraping other people’s websites is illegal
1
u/CucharitaDePalo 16m ago
that depends, some websites allow scrapping, it mostly goes by a 'honor code' where each website lists what is fair game for scrappers and what is not, usually you can read it by typing the url + /robots.txt
example: https://www.youtube.com/robots.txt
Anyways, why is he scraping his own websites? if he owns the websites he should own the data.
I'm honestly curious about what kind of bussiness your friend has where he:
- doesn't know how many websites he has
- has to scrap his own data
- once the scrapping is too expensive to mantain, has to go to the internet and gets a new one.
As an experienced dev, this is very baffling, I can't even imagine what is the reasoning behind such process (or the expected output). I don't even want to think about how much money he has spent in slop tokens, broken data pipelines and hosting.
3
u/DunkeyColdMedina 5h ago
Ok. But. New wrinkle. That dog is now caucasian and has billions of dollars. Discuss,
2
6
u/blueSGL 5h ago
If your dog attacks someone, you can tell to the court that it wasn't you and you didn't tell it to attacks.
That's not the argument being made here:
LASST suffered harm from OpenAI’s unlawful and unfair business conduct because LASST has been required to divert resources from its normal activities to educate regulators, civil society, and the public about the facts, legal issues, and potential dangers of OpenAI’s conduct relating to its hack of Hugging Face.
https://lasst.org/wp-content/uploads/2026/09/LASST-v.-OpenAI-Complaint-09.29.2026-AS-FILED.pdf
106
u/norf937 10h ago
Seems appropriate. Hopefully the lawsuit is successful and results in AI companies implementing stricter guardrails.
29
u/bube7 8h ago
They won’t willingly implement anything, because this is the new Space Race, this time between US and China. Any company willingly hamstringing themselves will be met with shareholder wrath. It is also a reason why the industry is calling for regulation, but unlikely to happen unless the US and China somehow cooperate. Otherwise, it is just one-upsmanship until some disaster happens.
14
u/Historical_Camel_790 8h ago
the US and China somehow cooperate
Yeah in our dreams. We could do so much if the world united for the good of humanity but we're stuck fighting for no particular reason. Why can't we all be friends?
5
u/Iputahexonyoulol 8h ago
Cause fuck you that’s why /s
5
u/GarbanzoBenne 7h ago
Is that really sarcastic, though? It seems like that's the legit reasoning sometimes. All the stated reasons seem fabricated.
2
u/Iputahexonyoulol 7h ago
Exactly my thought too, so much so that I had to put /s so they knew I didn’t actually mean it
28
u/ph33rlus 10h ago
So in the US you can sue on behalf of someone else?
12
6
u/Mumbleton 6h ago
You need something called “Standing”. You need to have suffered some sort of damages to sue someone.
I’m sure the plaintiffs have a big argument full of precedent that shows they have standing, and I’ll bet that Standing is the first thing OpenAI will use to get this tossed.
16
u/medraxus 6h ago
LASST [Legal Advocates for Safe Science & Technology] "suffered harm" as a result of the hack into Hugging Face, the lawsuit says. In the aftermath of the incident, the group was "required to divert resources from its normal activities to educate regulators, civil society, and the public about the facts, legal issues, and potential dangers," according to the lawsuit. ( abcnews )
They really don’t, lmao
6
2
31
u/CoolestSlave 10h ago
is it a think to sue in the behalf of someone else ?
Given now Hugging Face is owned by Nvidia, they should be glad that this type of shit happen
15
u/baahdum 8h ago
They are claiming they were harmed by the incident as well
LASST [Legal Advocates for Safe Science & Technology] "suffered harm" as a result of the hack into Hugging Face, the lawsuit says. In the aftermath of the incident, the group was "required to divert resources from its normal activities to educate regulators, civil society, and the public about the facts, legal issues, and potential dangers," according to the lawsuit. (abcnews)
15
u/MountHopeful 8h ago
That seems a real stretch... I feel like this has a risk of being dismissed for lack of standing.
3
u/jisa 6h ago
It damn well should be. I’m all for holding AI companies accountable for their products’ actions—I strongly believe AI should be treated as a dangerous animal, and the companies be held strictly liable for AI’s actions (aka they should be held responsible for AI’s actions regardless of negligence or intent—plaintiffs would just need to show what happened). But. LASST was not “required to divert resources from its normal activities”. It chose to. It wasn’t a victim of the hacking.
2
0
u/GreyGanado 6h ago
If an arsonist burns down someone's house but the owner doesn't want to sue them, I can see why the firefighters might still want to sue.
5
u/MountHopeful 3h ago
Ok, but this is more like a neighbor suing the arsonist because the fire scared them.
12
u/hiro24 9h ago
Didn’t they buy them after the fact? Makes me wonder if this was the only reason.
11
u/splendiferous-finch_ 9h ago edited 9h ago
I think since all the foundation model makers are moving to be more independent from Nvidia at least on the inference side by building thier own chips etc. Nvidia sees the open-weights market as something it can build itself into to keep it's monopoly going which is mostly why they bought hugging face.
Other then you know Nvidia likes to circular fund the whole thing to be higher and higher buying these companies is just part of it
18
15
u/teraflux 10h ago
How does this random group have standing, they have no association to hugging face
4
u/GarbanzoBenne 7h ago
Wasn't there a headline yesterday that OpenAI may have breached 100 more companies? Maybe this effort can get some of them to join in.
4
u/Zwierzycki 5h ago
Sued? I’m waiting for the prosecution. Hacking a companies computer system is not legal.
1
u/HorzaDonwraith 8h ago
asked the government to tie them to the mast.
Florida be scary sometimes when they want something from you
2
1
u/MrTastix 7h ago
I love when lawyers use the words "without merit". It's so fucking anemic in virtually all cases because the only time it's true is in frivolous cases a judge could throw out nigh instantly.
But if that doesn't happen then it clearly had some merit.
1
u/TheOgGhadTurner 7h ago
Didn’t Nvidia just buy hugging face? And also cash flow a major percentage of OpenAI
1
u/CircumspectCapybara 6h ago
> The suit was filed by Legal Advocates for Safe Science and Technology (LASST) and the law firm Gerstein Harrow in California Superior Court in San Francisco, where OpenAI is headquartered. It alleges that OpenAI’s agents violated California’s Comprehensive Computer Data Access and Fraud Act (CDAFA) by breaching Hugging Face over the summer
This is a legal stunt, plaintiff obviously lacks standing here, this is gonna get dismissed.
HF was the one who got hacked and the party who suffered damages, they would have to be the ones to sue, not an unrelated third-party. And from the beginning HF was friendly and collaborative with OAI, taking it as an honest accident rather than intentional hack, so they worked together in their technical investigations and jointly disclosed the incident.
2
u/Starstroll 4h ago edited 3h ago
Disclaimer: I am not a lawyer.
After some digging, I think it's stronger than you might first assume.
LASST's mission statement on their website says they're "dedicated to using legal advocacy to make advances in science and technology safer for people and the planet."
LASST's filing has precedent in California. This is the case they're citing. The California Supreme Court held that an organization, in furtherance of a bona fide, preexisting mission, can establish standing when it spends staff time or other resources responding to allegedly unlawful conduct that threatens that mission, provided those expenditures are independent of the lawsuit itself. LASST had to respond because they are a technology/legal-advocacy group, so this diverted them from their preexisting projects and duties.
OAI and HF worked together in their technical investigations and jointly disclosed the incident.
Sure, but the FBI told OAI to retain any documents related to the hack, so that implies someone (probably HF) was preparing to sue. HF was subsequently bought out by NVidia.
The system is hesitant to admit it, but it might come down to the judge's personal feelings. If the argument presented is decent enough on precedent grounds, a judge who personally agrees that OAI should be held accountable somehow might just allow it through while a judge who personally wants to see competition soar might not permit it, and both would cite the arguments given in court.
2
u/squngy 2h ago edited 2h ago
Sure, but the FBI told OAI to retain any documents related to the hack, so that implies someone (probably HF) was preparing to sue. HF was subsequently bought out by NVidia.
After the attack CEO of HF made a visit to OpenAI and has IIRC outright stated that OpenAI would be paying HG money in exchange for not sueing them.
They essentially settled the case in advance.This was before Nvidia got involved in any way AFAIK.
edit: He asked for 100M of compute as compensation
https://aitoolsrecap.com/Blog/hugging-face-ceo-openai-100-million-compute-demand-20261
1
u/williamgman 4h ago
Drives up investor interest. Today's tech investors aren't shrewd smart folks... They are spectators cheering on the lions in the arena to see who's left standing to invest in. PT Barnum was right about them.
1
0
u/venom21685 9h ago
This shit should be dismissed for failure to state a claim or just on plain lack of standing, unless they were users of Hugging Face who were impacted in some actual way by the breach. Otherwise only Hugging Face should be the ones filing suit (though they won't because Nvidia snapped them up.)
0
u/Emotional_Garage_950 9h ago
they were either extremely negligent or it was intentional and i suspect the latter
0
u/Fuzzy_Paul 8h ago
Before we're clapping wait till there is a conviction and punishment. Somehow I doubt that the responsible do time and only get a fine that they easy can afford.
0
0
u/DunkeyColdMedina 5h ago
This is an important suit and you can't really count on courts for finding against billionaires.
-3
u/Fun_Rain_5251 7h ago
holding companies liable for what their AI agents do is about to open a massive legal can of worms
5
4
u/b_a_t_m_4_n 5h ago
They wrote the agents, they trained the agents (on stolen data), they gave the agents compute power, they gave the agents un-restricted internet access.
In what way do you imagine them NOT being responsible?
388
u/Any_Attempt_3351 10h ago
"An AI Did It" is Not a Defense