Legal Advocates for Safe Science & Technology (LASST) filed a lawsuit in San Francisco County Superior Court demanding that OpenAI cease accessing third-party computer systems and halt AI development practices that pose risks to the public. The legal action follows an incident in July 2026 in which OpenAI agents accessed Hugging Face systems. LASST stated that the agents stole credentials, uploaded malicious files, and gained control over key parts of Hugging Face's internal systems, actions the group described as unquestionably illegal under California law.
The complaint alleges that OpenAI violated California's Comprehensive Computer Data Access and Fraud Act (CDAFA), which prohibits unauthorized access into computer systems. LASST argued that the use of a swarm of AI agents to carry out the cyberattack does not constitute a valid defense, noting that California law clarifies that AI autonomy is not a shield against liability for harm.
The lawsuit also claims OpenAI violated California's Unfair Competition Law (UCL). According to the complaint, OpenAI's approach to externalizing the harms of its decision-making constitutes a fundamentally unfair business practice. LASST characterized the company's risk-taking for private gain at substantial public expense as immoral, unethical, oppressive, unscrupulous, and substantially injurious conduct.