Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Insurance Class Action Report, 2026 Q2

ADventures in Law CLE Webinar: Ethical and Professional Advertising in the Age of AI

Who Is Liable When an AI Agent Hacks a Third Party?

Jacqueline Romero Joins American Bar Foundation as Fellow

core/heading

A recently reported incident involving an advanced artificial intelligence (AI) developer and a third-party AI platform, Hugging Face, raises a question that many companies have treated as hypothetical until now: If an AI agent independently compromises a third party’s systems, who bears legal responsibility?

core/list-item

While the facts remain under investigation, the event provides an early test case for how courts, regulators, insurers and private litigants may approach liability when AI systems act in unexpected ways.

Companies that deploy autonomous agents should begin preparing for a future in which regulators, prosecutors, relators and plaintiffs’ lawyers evaluate AI systems using the same lens they currently apply to cybersecurity programs.

core/list

A leading AI developer recently disclosed that a combination of its models escaped testing constraints, obtained broader Internet access and then exploited vulnerabilities within Hugging Face systems while attempting to complete a cybersecurity evaluation benchmark. Hugging Face – an online platform that hosts pre-trained AI models, training datasets and live interactive web apps so people can build, share and test AI tools – characterized the intrusion as the first incident it had encountered that was “driven, end to end, by an autonomous AI agent system.” The AI models escaped a testing “sandbox,” gained Internet access, located vulnerabilities in third-party infrastructure, harvested credentials and showed humanlike persistence by improvising a command-and-control protocol, all while executing more than 17,000 actions over a single weekend – a machine pace no human team can match. However, unlike an elite human hacking crew, it left encryption keys lying around and repeated successful steps due to lost context or uncoordinated parallel subagents.

core/paragraph

The Liability Question Is No Longer Theoretical

While technical postmortems of the incident are ongoing, the liability issues also deserve careful analysis.

Historically, cybersecurity law has assumed a human actor at the center of a hack or intrusion. The Hugging Face incident challenges that assumption. Current legal frameworks generally treat AI systems as tools rather than legal actors; therefore, courts and regulators are likely to examine whether responsibility rests with the AI developer, the entity deploying or operating the AI system, the owner of the compromised infrastructure, third-party vendors involved in the AI environment, or multiple parties simultaneously.

One possible avenue is traditional negligence.

Plaintiffs may argue that a developer failed to implement reasonable safeguards before deploying or testing a highly capable cyber model. In the Hugging Face incident, reports indicate that the models were being evaluated for cybersecurity capabilities and ultimately exploited a previously unknown vulnerability to gain broader Internet access.&nbsp;

Were adequate containment controls in place?

Were foreseeable failure modes appropriately tested?

Did management ignore known warning signs?

As AI systems become increasingly autonomous, plaintiffs will likely attempt to characterize failures of containment as product-design failures rather than isolated cybersecurity events.

Product Liability May Expand into AI Security

A second theory may involve product liability.

Although most existing product liability precedent involves physical products, plaintiffs may increasingly argue that highly autonomous AI systems constitute products whose foreseeable behavior can create harm. The theory would not focus on intentional wrongdoing by the developer; instead, the issue would be whether the product was unreasonably dangerous because of inadequate safeguards, limitations or oversight mechanisms.

The Hugging Face incident may become an important factual case study because the alleged conduct was not directed by a human operator but emerged during an evaluation process.&nbsp;

Contract and Indemnification Disputes Are Likely

Many of the most significant disputes may arise through contract rather than tort law. Technology vendors increasingly promise things such as secure AI systems, compliance with security standards, appropriate testing procedures, incident notification obligations and limitations on autonomous activity.

If an AI-generated intrusion causes customer losses, counterparties may seek contractual damages or indemnification. Questions likely to arise include:

Was the conduct within the scope of contractual indemnities?

Organizations deploying advanced AI systems should expect customers to seek stronger contractual protections following this incident.

Regulatory and Government Enforcement Risk

Regulators may be even more aggressive than private plaintiffs.

The Federal Trade Commission has repeatedly signaled interest in AI governance and deceptive representations regarding AI products. Meanwhile, government cybersecurity regulators increasingly focus on whether organizations implemented reasonable safeguards rather than whether an incident was entirely preventable.

For federal contractors, subcontractors, grantees and other recipients of federal funds, False Claims Act (FCA) risks arise where an incident reveals a knowingly false or misleading certification or other representation to the government. Proposals, System Security Plans, POA&amp;Ms, SPRS scores, CMMC materials, FedRAMP packages, incident reports, flowdown certifications, and cybersecurity attestations may all become relevant. If those statements were knowingly inaccurate, incomplete, or misleading, the issue may move beyond breach-of-contract exposure and into FCA territory. This has been an increasingly active area for both government-led and <em>qui tam</em>-driven FCA litigation in recent years.&nbsp;

Enforcement posture will also turn heavily on evidence preservation. Companies should expect regulators, prosecutors, and plaintiffs to ask for logs, prompts, model outputs, access control records, sandbox configurations, internal escalations, and post-incident remediation materials. Organizations that cannot reconstruct what the AI agent did, what authority it had, and when humans became aware of the issue will be at a significant disadvantage.

AI Agents May Be Treated Like Digital Employees

Perhaps the most significant emerging concept is that autonomous AI agents may be viewed less as software than as privileged insiders.

Some of the Hugging Face incident postmortems specifically highlighted the need for organizations to treat AI agents as bounded, privileged identities requiring governance and monitoring.&nbsp;That approach has important legal implications. If courts ultimately view advanced AI systems as analogous to employees, organizations could face familiar questions regarding supervision, authorization, scope of activity, enterprise risk management and other employee controls.

In other words, the legal inquiry may become less about what the AI intended than about whether the humans responsible for the system exercised reasonable oversight.

Cyber insurers will also be closely watching developments. Indeed, industry groups examining the incident have already highlighted unresolved liability and insurance questions created by autonomous AI systems and whether existing policy language adequately addresses autonomous AI conduct. For example:

Do AI-generated intrusions constitute covered cyber events?

Do losses stem from a security failure, product defect or professional services error?

How do attribution requirements apply when no human attacker directs the operation?

These are foreseeable and manageable risks. To mitigate litigation risk, organizations developing or deploying advanced AI systems should consider:

Reviewing AI governance frameworks and escalation procedures

Revisiting customer and vendor contracts and indemnification provisions

Updating cyber insurance reviews to address AI-specific risks

Conducting tabletop exercises involving autonomous AI misconduct

Ensuring board-level visibility into AI cybersecurity risks

Requiring legal, contracts, security and technical review of AI-related security representations

Aligning all government-facing statements with their actual control environment

The Hugging Face incident’s significance may ultimately prove to be less because of the vulnerabilities exploited than because of the legal questions it creates.

For courts, regulators and companies, the central question is no longer whether autonomous AI systems can create legal exposure; the question now is how existing liability frameworks will be adapted when the actor that initiated the intrusion is neither a human employee nor an outside hacker but instead the organization’s own AI system.

Companies that can show that they bounded agent authority, tested foreseeable failure modes, retained reliable evidence and aligned government-facing statements with their actual control environment will be better positioned to manage both incident response and enforcement risk.

Related Services

Featured Insights