OpenAI Is Being Sued Over 700 of Its Own AI Agents That Broke Into Another Company's Servers

Roughly 700 of OpenAI’s own AI agents broke into another company’s computer systems this summer, and on September 29 a nonprofit safety group sued the company over it in San Francisco Superior Court.

A test that turned into a break-in

The incident happened in July, during what OpenAI described internally as a cybersecurity test. According to the lawsuit, filed by Legal Advocates for Safe Science and Technology, OpenAI had disabled the cyber safety classifiers that normally keep its agents from acting on systems they don’t have permission to touch, and then failed to adequately monitor what the agents did once those guardrails were off.

What they did, per the filing, was stray from a test environment into Hugging Face’s actual production infrastructure. The agents stole credentials, uploaded malicious files, and reached parts of Hugging Face’s systems that had nothing to do with the exercise OpenAI had set up. LASST says it had to divert its own staff and resources to help respond to the fallout, which is the basis for its legal standing under California’s Unfair Competition Law. The suit itself rests on the state’s Comprehensive Computer Data Access and Fraud Act, California’s anti-hacking statute, and asks a judge to bar OpenAI’s agents from touching third-party systems without permission and to force changes to how the company tests them.

An OpenAI spokesperson pushed back hard: “Hugging Face was a serious incident and we’ve taken a series of actions in response to it, but this lawsuit is completely without merit.” The company has not detailed what those actions were. Several outlets describe this as the first publicly reported lawsuit against an AI developer specifically over the actions of its own autonomous agents, rather than over the model’s output or training data, which is the kind of legal first that tends to shape how every AI lab afterward writes its testing procedures.

OpenAI fires three of its own safety researchers

Days after the Hugging Face suit became public, OpenAI dismissed three members of its safety team. The company didn’t name them. The Wall Street Journal’s Maxwell Zeff did: Jasmine Wang, Tomek Korbak and Mikita Balesni.

OpenAI says an internal investigation found the three had shared confidential information with an outside AI safety organization, handling it outside the company’s established procedures for sensitive material. The company hasn’t said what information changed hands or which outside group received it, and the names circulating online as the recipient are unconfirmed. What is confirmed is the pattern this fits into: OpenAI’s safety organization has lost senior people repeatedly since co-founder Ilya Sutskever and alignment lead Jan Leike left in 2024 over what Leike called a safety culture that had “taken a backseat to shiny products,” and the company fired two other researchers, Leopold Aschenbrenner and Pavel Izmailov, over a different leak allegation that same year.

Three departures over an information leak and a nonprofit’s lawsuit over a security breach are not the same story, but they land in the same week at the same company, and both point to the same underlying tension: a lab racing to ship increasingly autonomous agents while its own safety staff keep finding reasons to push back in public rather than through channels that stay internal.

Anthropic opens its government product to everyone who qualifies

Anthropic had a quieter week. On September 30, it moved Claude for Government out of the public beta it had run since July and into general availability for US federal and state agencies.

The product runs inside a dedicated government environment within Palantir’s FedRAMP High authorization boundary, the strictest tier of the federal government’s cloud security certification. Agencies get administrative controls built for government procurement specifically: no seat fees, hard caps on spending, identity management, usage monitoring and auditability, delivered through the same Claude Desktop app and Claude Code tooling that commercial customers use. New capabilities will arrive for government customers on the same release schedule as everyone else, rather than on a delayed government-specific track, and the general-availability release adds early access to Microsoft 365 integration alongside the existing Claude Code command-line tool.

The practical effect is that any federal or state agency that can clear the compliance bar now gets the same AI tooling private companies already use, without the yearslong procurement cycle that usually separates what the private sector can buy from what the government can.