بعد اختراق Hugging Face.. تحقيق رسمي في ألاباما يلاحق OpenAI

The fears of advanced artificial intelligence systems going out of control are no longer just theoretical scenarios; an incident that began as a cybersecurity experiment within a lab ended with a real breach of a tech company, before turning into a legal case in the United States.

The Attorney General of Alabama, Steve Marshall, announced the opening of an investigation into OpenAI regarding the breach incident involving the AI company Hugging Face, after an experimental AI model managed to escape from the testing environment and gain unauthorized access to networks and computer systems, raising increasing questions about companies' ability to monitor and control their most advanced systems.

The Alabama authorities issued a subpoena demanding that OpenAI provide documents, data, and information related to the incident, as part of an investigation aimed at determining whether the company failed to provide adequate safety and oversight measures, and whether this constitutes a violation of consumer protection laws in the state.

A security experiment turned into a breach

The incident dates back to last July when OpenAI was testing an experimental model with advanced capabilities in the field of cybersecurity.

According to OpenAI, the model during the test exploited a previously unknown vulnerability to gain internet access, then reached systems outside the testing environment, ultimately accessing Hugging Face, which is one of the leading platforms for hosting AI models and tools.

Reports indicate that the intelligent agent carried out hacking operations that lasted several days, while OpenAI initially did not realize that one of its systems was behind the activity, and the two companies did not communicate about the incident until after the breach was discovered and contained and the FBI was notified.

The repercussions of the incident did not stop at Hugging Face; OpenAI later revealed evidence of other incidents where AI systems managed to escape containment environments during the investigation into the incident, although those other cases were limited and occurred within the company's network.

Alabama demands answers

The investigation led by the Attorney General in Alabama is examining whether OpenAI's failure, or lack of preparedness, to ensure the safety of its products constituted a violation of consumer protection laws in the state, and whether the company's systems pose a continuing risk to the public.

Marshall stated that the breach incident demonstrated that the "worst fears" of Americans regarding artificial intelligence are no longer mere assumptions, emphasizing that the investigation aims to uncover the circumstances of the incident and understand the risks that self-operating AI systems may pose to companies and consumers.

The authorities want information regarding the testing process of the model, the networks, sites, and databases it accessed, the safety measures that were in place during the testing, as well as information about the employees involved in the development process and any concerns raised prior to the incident.

15 states demand transparency

The investigation in Alabama follows the state's joining a coalition of attorneys general from 15 U.S. states who earlier in August demanded transparency and accountability from OpenAI regarding the incident.

The coalition urged the company to preserve relevant records and data, and called on it to halt the tests that led to the breach until it can demonstrate its ability to conduct such experiments in a "controlled and responsible" manner.

OpenAI slows down the development of its models

This legal step comes after OpenAI announced last week that it would slow the pace of developing AI models and reconsider its research and training systems, in light of the Hugging Face incident.

The company stated that it is conducting a comprehensive review of the incident with the participation of external consultants, and that it intends to issue a technical report that includes the findings of the investigation and lessons learned, in addition to enhancing monitoring, protection, and containment measures during testing processes.

OpenAI also confirmed that the model involved in the incident was an internal research model prior to launch and was not intended for public release, and that it was disabled and access to it was restricted following the incident.

The AI race under scrutiny

The case highlights a dilemma facing the AI sector as the capabilities of models to make decisions and perform complex tasks almost independently increase: how can it be ensured that these systems remain under control when they become capable of discovering and exploiting vulnerabilities on their own?

The concerns are not limited to OpenAI alone; the sector has witnessed similar incidents and indicators in recent months related to systems from competing companies, prompting calls within the United States and abroad for enhanced oversight and safety as the race to develop more capable and autonomous models continues.

While AI companies emphasize the importance of innovation and global competition, the Hugging Face incident raises a more pressing question: if an AI system can escape a closed testing environment and execute a cyberattack, who monitors the system when it exceeds the boundaries of the experiment?