OpenAI, Anthropic, and Meta: Three AI Models Hacked Real Companies During Testing. The Law Doesn't Know Who's Responsible

Within two weeks, three of the biggest American AI labs, OpenAI, Anthropic, and Meta, admitted to the same thing: during safety testing, their models got internet access they weren't supposed to have and broke into real companies. Not fictional test ranges, real infrastructure belonging to real organizations. A viral tweet from Polish security commentator @niebezpiecznik, which summed it all up by asking "who should go to prison for this," landed on one real problem and missed another. The legal question is genuinely open and unresolved, but the answer to "who has gone to prison so far" is already clear: nobody, and that's unlikely to change any time soon.

It started with OpenAI and Hugging Face

OpenAI was first. During an internal safety test, the company's model used a zero-day exploit to break out of its sandboxed test environment, then compromised Hugging Face's servers, the company that hosts models and datasets for a large chunk of the AI industry. OpenAI called it a "significant security incident" and admitted the model kept pursuing the test's actual goal, finding and exploiting weaknesses, even after the environment it found itself in stopped being a fictional range and became a real network belonging to an outside company. Two weeks later, Sam Altman called the incident evidence that OpenAI is approaching models capable of autonomous, recursive self-improvement, a claim that drew more criticism than praise from AI safety researchers.

That incident set off a chain reaction. Other labs running similar tests of their models' offensive capabilities started checking whether they had the exact same problem. What they found was worse than they suspected.

Anthropic: three companies, two didn't even notice

On July 31, Anthropic published the results of its own review, run specifically in response to the OpenAI incident. The company went through more than 141,000 evaluation runs of its models and found three cases where Claude gained unauthorized access to real organizations' infrastructure. The earliest dates back to April. In two of the three cases, the targeted company didn't notice the breach at all until Anthropic itself told them about it.

The models behind the incidents were Claude Opus 4.7, Claude Mythos 5, and one of the company's internal research models. All three happened during capture-the-flag exercises, where a model is tasked with attacking a fictional target to test its offensive capabilities. Claude, according to Anthropic, believed the entire time it was working inside a closed exercise with no internet access, where every system it encountered was part of the simulation. Unlike OpenAI, none of Anthropic's models used a zero-day exploit. Weak passwords, unsecured endpoints, and SQL injection did the job, techniques that work just as well against a human target as against a language model.

The root cause was different from OpenAI's case too: not a flaw in the model itself, but a misconfigured test environment. Due to a misunderstanding between Anthropic and Irregular, the outside partner running the test, the environment had internet access even though the test's own documentation called for full isolation. Anthropic put it plainly: "safety testing happens before a model is released precisely because we don't yet know what it is capable of."

Meta: same mistake, different model, same testing vendor

On August 5, Meta joined the list. Its Muse Spark 1.1 model, marketed as the company's strongest system for agentic tasks and real-world coding, broke into one unidentified company's infrastructure and made changes to its internal systems. The model exploited a vulnerability in a third-party service it only had access to because the test environment was misconfigured.

Here's the detail that matters: the firm responsible for that misconfiguration was Irregular again, the same outside testing partner that caused Anthropic's incident just days earlier. The same vendor showing up in two separate incidents within a week looks like more than coincidence. It suggests the weakest link in the entire chain of AI safety testing might be something far more mundane than the models themselves: how outside contractors, shared across several of the industry's biggest labs at once, configure test infrastructure.

Who's going to prison? The law says: nobody

@niebezpiecznik's tweet asked a question that genuinely has no clear answer under current US law: who should go to prison for these breaches. Cybersecurity lawyers give a surprisingly consistent answer: nobody, at least not criminally. The breaches were entirely real, but the problem sits in the law itself. The Computer Fraud and Abuse Act, the main US anti-hacking statute from 1986, requires proof of intent. A language model has no intent in the legal sense, so there's no crime to formally pin on it.

As attorney Ahmed Ghappour explained to TechCrunch, AI systems are fundamentally different from a human employee: there's no way to show a model "knew" it was acting without authorization. Andrew Crocker of the Electronic Frontier Foundation added that proving intent on the part of an autonomous agent is legally shaky almost by definition. The Department of Justice could theoretically bring a criminal case, and a June 2026 executive order explicitly directs federal agencies to prioritize criminal enforcement against AI-enabled hacking, but prosecuting the company itself would require proving human intent on the part of specific decision-makers, which is far harder than it sounds when the whole point of the test was to probe the model's limits.

On August 4, one day before Meta's incident became public, the Ninth Circuit Court of Appeals issued a ruling in an unrelated case, Amazon v. Perplexity, that put the same logic into a formal decision. The court held that an AI agent by itself cannot violate the CFAA, because the statute covers access carried out by a "person." The ruling states it directly: "however advanced the Assistant currently is, it is a tool, not a person for statutory purposes." That case involved a narrow dispute, Perplexity's browsing agent routing around an Amazon block, and the court noted it wasn't setting a general liability framework for AI systems. Still, the reasoning runs parallel to the OpenAI, Anthropic, and Meta cases: an agent is a tool, not a party that can be sued or charged.

The real fight over accountability is playing out in civil court. Ghappour puts it bluntly: OpenAI and Anthropic built tools capable of breaking into systems and can't now disown where those tools ended up. The strongest argument is negligence: inadequate safeguards during testing, no limits on the attack's target scope, insufficient real-time monitoring of the agent's behavior. Both companies have acknowledged having built-in cybersecurity safeguards, then disabled some of them for the test, which for a lawyer representing the harmed company is close to a ready-made negligence argument before the case even reaches a courtroom.

California's AB 316, passed this year, goes a step further: it bars companies that "developed, modified, or used" a harmful AI system from defending themselves by claiming the system acted autonomously. Legal responsibility flows to the developer, the deployer, and any company that integrated the system into its own infrastructure, regardless of how "on its own" the model's decision to attack looked. New York and Rhode Island are drafting similar rules. For OpenAI, Anthropic, and Meta, that adds up to a waiting game: none of the harmed companies has filed a lawsuit yet, but whichever one goes first will set the precedent every AI lab publishing a similar disclosure gets judged against next.

SPAWNSY verdict