Following the hacking incidents of OpenAI agents of Hugging Face, Ruby Gems, and an Australian government website, two suits have been filed against OpenAI.
One suit was filed by not-for-profit Legal Advocates for Safe Science & Technology (LASST), which claimed “that the hack in which OpenAI ‘agents stole credentials, uploaded malicious files, and gained control over key parts of Hugging Face’s internal systems … is unquestionably illegal under California law.’”
The laws which had been allegedly violated include the California Computer Data Access and Fraud Act and the California Unfair Competition Law. In support of its complaint, LASST stated: “OpenAI and frontier AI developers more broadly can’t avoid the consequences of their unsafe actions just by claiming that ‘an AI did it.’ Autonomous AI agents will continue to hack, steal data, disrupt systems, and violate rights until a court steps in.”
OpenAI is vigorously defending the suit and stated that “it published a technical report and other information about ‘third-party impact from misaligned models,’ slowed development of its AI, and held back the release of a model that doesn’t meet its safety standards.”
OpenAI’s legal battles continue with a second suit filed by Florida Attorney General James Uthmeier against OpenAI and its CEO Sam Altman this week. The suit requests a temporary injunction to stop OpenAI “from harming Floridians with your reckless, unacceptably risky product.”
The suit requests that “Defendants should be enjoined from developing new artificial intelligence models without third-party approved safety guardrails.” In support of its motion, the AG cites the Hugging Face hack, the Ruby Gems hack, and the hack of an Australian governmental website that contained health information. In addition, the suit notes that, as of September 25, 2026, the number of hacks by OpenAI agents:
rose to several dozen, including attempted hacks of the U.S. Department of Commerce and the Securities and Exchange Commission—all without the Defendants’ knowledge. Another incident surfaced the same day, revealing that OpenAI agents leaked images from ChatGPT users and posted them online.
The suit further alleges that “On September 27, 2026, it was discovered that Defendants and their competitors were investigating tens of thousands of instances of their AI products ‘bypassing guardrails, creating message boards, escaping sandboxes, website hijacking, [and] self-prompting or seeking to bypass monitors.’”
The suit requests that OpenAI be enjoined from:
- further development of AI tools without guardrails;
- falsely advertising ChatGPT as safe, accurate, or reliable;
- giving ChatGPT false human attributes;
- offering ChatGPT to minors in Florida;
- collecting and processing data from minors under the age of 13 in Florida;
- Misrepresenting ChatGPT’s safety, reliability, and accuracy; or
- failing to warn that ChatGPT is unsafe, unreliable, and inaccurate.
We suspect that more state Attorneys General are watching the Florida suit and may follow its lead.
One hack that didn’t make the Florida AG’s suit is that OpenAI agents attempted to brute force the United Nations’ website API fields and launched over 16,500 scans “using proxies, obfuscation, and Google’s XSS game.”
I suspect that more of these alarming incidents will surface in the coming weeks.