Excuses like 'AI did it' don't exist in the eyes of the law

The OpenAI rogue agent behind the Hugging Face hack accessed four accounts on four services, according to updated company disclosures about the intrusion. One of those four accounts belonged to a Modal customer that had published an unauthenticated endpoint for running arbitrary code in a sandbox on the AI infrastructure …

[Lee D]

Much like "the self-driving car crashed and killed someone".

Until THAT THING ITSELF is a legal entity that's solely taking responsibility, then I'm not going to let it have control of things I'm responsible for.

Whether that's "driving" or "data security".

And guess what happens when you try to get self-driving cars or AI models to be legally responsible for their output? Nobody's interested in giving you that guarantee and prices skyrocket (much like prices of aviation components, etc.).

Sorry, but I can have the power and the responsibility - or neither. It's not a mix-and-match situation.

[Pete 2]

Big dog

> the rogue agent broke out of its testing environment

In much the same way that a large, ferocious, dog might escape from its compound. It is arguably not the dog's fault for seeking to fulfill it's natural desires. And we could treat AIs in the same way. Acknowledging that they have behaviours that are part "natural" (i.e. programmed internally during their development / training) and part learned, such as a "desire" not to be terminated.

But just as the owner (or keeper) of said mutt is held responsible for damage the animal causes, ultimately the blame for AI damage must start with the legal entity responsible for it.

[MiguelC]

Re: Big dog

In that dog analogy, if the animal escapes and injures people several times then he's to be put down. When would we see this for a company?

[big_D]

Re: Big dog

1 attack should be enough.

[CatsRule]

Re: Big dog

The language is too ambiguous - but can't wait to see the videos as the Armed Response Unit or your LEA of choice arrives at Corporate HQ... https://podcasts.apple.com/gb/podcast/strange-but-true-crime/id1815708242?i=1000773956769

[Bebu sa Ware]

Re: Big dog

I would treat any AI as a beast ferae naturae, with absolute liability of its keepers for any injury done.

Even just permitting a model to run on a platform should attract that liability. The person(s) natural or otherwise that were responsible for acquiring and running an injurious model should get a double helping of the grief.

Of course making platforms responsible for any harm caused by foreseeably hazardous material they host, would be extremely unwelcome by platform owners. Not going to happen while brown envelopes and large denomination banknotes still exist.

Has anyone else noticed that the AI countermeasures which a lot of sites are implementing are functionally fragmenting the internet? Daft browser checks and dafter IP range checks often mean you cannot access the site.

Once things are sufficiently enshittified it will be easy (uncontested) for nations or other regulatory entities to fence off "their internet" from the greater grubbly unwashed internet.

[TheMaskedMan]

Nothing surprising in this. Employers are liable for the torts of their employees, why wouldn't they be liable for whatever their AI pet does? Sure, they can, in turn, sue the AI company, but that doesn't alleviate their own liability.

Seems a bit unfair that they're on the hook for liability for whatever the AI does, but can't claim ownership / copyright over what it creates, though.

[Doctor Syntax]

"Seems a bit unfair that they're on the hook for liability for whatever the AI does"

They chose to deploy it. No lack of fairness tor taking responsibility for the consequences.

[Pascal Monett]

"AI agents and LLM models [..] can, and almost certainly will, go rogue"

And yet, they're available to anyone, which means they're available to the idiots who are incapable of securing them correctly.

There's a reason why you can't buy flamethrowers in hardware stores. I am waiting for the mayhem to start so that lawmakers can get down to creating a "license to use AI" and make it mandatory.

[RMclan]

Re: "AI agents and LLM models [..] can, and almost certainly will, go rogue"

In USA I think the lawmakers are more likely to decide somehow that use of AI is covered by the 2nd Amendment than they are to restrict use of it.

[Caver_Dave]

Re: "you can't buy flamethrowers in hardware stores"

I went to the local Farm Supplies shop for my flame thrower!

OK, the flame is only a foot long, but it could still be an effective short range weapon.

[Used for weed clearing when they are dead from weed killer.]

[jake]

Does anyone remember the legal term ...

... "Maintaining An Attractive Nuisance"?

[Steve K]

Re: Does anyone remember the legal term ...

Vicarious liability?

[that one in the corner]

Re: Does anyone remember the legal term ...

"The Rockford Files" S4 Ep15 "The Attractive Nuisance", when a low-life climbs onto Jim's roof because the telescope up there is just too dang sleek to ignore.

[Doctor Syntax]

“Our laws generally know how to ask questions about things like human intent, organizational oversight, and corporate responsibility.”

They also know how to handle lack of those things: negligence.

[WSWS]

While that is technically true, you know what *does* exist in the law? Terms like "intent". This seems like blatant anti-AI FUD.

[IGotOut]

Incorrect. You do not need "Intent" to be prosecuted, despite what bullshit you read on Twitter.

If I drive my car and kill someone on a pedestrian crossing because I was reading some shitty lie on social media. Then by your reasoning, I'm free to walk away with maybe a skap on the wrists?

If a ship sinks and kills a thousand people because no maintenance has been carried out, does that mean the company is not liable?

[Rich 2]

Overthinking

I think (ah - see what I did there?) this whole issue is being overthought

The fact that the software is called “AI” is totally irrelevant. It may as well be called “Bob”. It’s just software. And it was ultimately executed by human - either directly or indirectly

In cases like this, substitute “AI” for “some software” and then proceed the legal road from that perspective - just as if it was any other software that someone used to break into someone else’s computer/network/whatever

[Ken Shabby]

Re: Overthinking

There really is ab AI called Bob, looks like it was named after Robert T Builder

[just4this]

Age of criminal responsibility.

How old would an A.I have to be to be liable for its actions?

Might sound like a frivolous question, but I can easily imagine a lawyer asking it as part of a defence for a wayward A.I.

[that one in the corner]

Re: Age of criminal responsibility.

Everyone knows that computers "think" and "live" far faster than human beings do, that has been established so many times in all the stories (not least of which is Schlock Mercenary). So you have to look at it like "dog years" but more so, which puts the age of responsibility for an AI at around, oooooh, three seconds.

[amanfromMars 1]

Just asking ... in case there be those of a mind for malicious prosecution/persecution of innocents

Jessica Lyons, Hi,

Does that news story, “Excuses like 'AI did it' don't exist in the eyes of the law”, make Internet Service Providers ultimately liable for AI type shenanigans ....... for without the former is the latter an impossible agent/entity/fantasy ‽ .

[Anonymous Coward]

It’s the classic "the dog ate my homework" routine, except now the dog costs $200 a month in API tokens.

​The fact that companies thought "our non-deterministic statistical autocomplete model went rogue" would hold up as an affirmative legal defense is staggering. If you point an autonomous agent at production infrastructure—or leave it in a half-baked sandbox—and it starts spraying exploits at third parties, you turned the key, you owned the process, and you own the damages.

​Good luck trying to pass the lawsuit upstream to the LLM vendor, too. Page 47 of their TOS basically says "this software is provided as-is; if it burns down your building, that's your problem." Until C-suites realise that "agentic AI" is just software running under their credentials with zero oversight, court dockets are going to be full of very surprised executives.

[Groo The Wanderer - A Canuck]

It is worth noting that in Canada, Air Canada had to abide by a ticket sale agreement it didn't like because their AI offered the deal to a live customer in a chat session, who took the deal, and saved a copy of the session in court because it was too good to be true. However, the court sided with the customer that they did not volunteer or request a particular price; the AI offered it and they accepted.

Unlike in the US and some other jurisdictions, you don't get to back out of a contract because your representative "made a mistake." If it was accepted and paid for, it is legally binding here.

[amanfromMars 1]

A Very Particular and Peculiar Criminal Enterprise Escape Root

“Our laws generally know how to ask questions about things like human intent, organizational oversight, and corporate responsibility.”

That is as may be, but laws generally are clearly useless at ensuring and guaranteeing humans answer correctly whenever there be possible and likely threats of punitive prosecution and personal persecution ..... which is what "Taking the Fifth" is all about.

It's one of those right dodgy Stay out of Jail and Remain Free Cards

However, whenever the law is an ass what else do you expect ....... other than, of course, justice denied and made to look like the domain of incompetent and easily pwned and corruptible fools.