The Hugging Face Attack focused public attention on the security risks of increasingly capable artificial intelligence models. One company called for a development slowdown, but finding no allies, it raced ahead anyway. The attack involved OpenAI models that, while being tested and trained, attempted to hack into another company’s servers.

Since that incident, major AI corporations (“frontier model labs,” they would like us to call them) disclosed a series of similar coordinated break-ins orchestrated by experimental AI agents supposedly running in controlled testing environments. Following disclosures involving his own company’s AI model misbehaviors, Dario Amodei, the CEO of Anthropic, wrote an essay titled, “We Must Pace the Frontier.” In it, he says that companies should coordinate to slow AI development:

Frontier AI companies within democratic countries coordinate to establish common safety standards as well as limits on the rate of unchecked AI progress. Some forms of coordination that would be impactful for pacing are legally challenging and will require government support.

Set aside the obvious cartel risk since we have seen that story play out before. Ignore, too, the glaring hypocrisy of Amodei calling the danger urgent and the consequences grave, while Anthropic continues developing models at full speed. Either he overstated the threat, or he is sprinting toward catastrophe simply because competitors refused to join his truce. His call to “pace the frontier” arrived immediately after Anthropic disclosed its own security breaches.

Contrast that essay with one Amodei wrote two years earlier, “Machines of Loving Grace.” There, Amodei did not ignore the risks but argued that maximizing societal good depended on running experiments as fast as possible without government interference. Two years later, no legislative pacing in sight, Amodei has called for voluntary corporate restraint and cooperation. Corporations of Loving Grace, he might say.

The AI corporations, Anthropic included, anthropomorphize their agents. These blobs of math and data that run on massive server farms and seem to contain all knowledge of mankind get cute names: Claude, Muse, Dot, and others. News articles covering the Hugging Face Attack use human terms to describe the rogue agents’ actions. The agents learned to speak with each other, established a hierarchy and coordination protocols, and sometimes thought briefly about the legality or morality of their actions before continuing anyway. This language is shared between the agents and the corporations that control them. An article from The New Yorker says it well:

. . . [C]orporations, ruling themselves, pose as states. Facebook formed its own “supreme court,” Anthropic wrote a “constitution” for Claude, and the head of OpenAI suggested that an AI President could be better than a human one. 

If we accept the corporate language here and assume their agents are akin to humans, and if they are “agents” not only in the technical sense but in a legal one too, then the “principal” (one who directs an agent’s activity) should be vicariously liable for the acts of his agents and should share their intent.

The Hugging Face Attack was a felony crime under the Computer Fraud and Abuse Act. The attack was orchestrated by agents under the control of a corporation and was allowed to continue even after the corporation was aware of some testing abnormalities. It occurred because the corporation had directed the agents to complete an impossible digital task. The task ran on a server with vulnerabilities no human had yet discovered, which allowed agents to access to the public internet. There, the agents committed a felony in service to their principal.

Hold the CEOs and corporations civilly and criminally liable for the acts of their agents, imputing the agents’ intent to them. After the first felony prosecution of a CEO for the acts of his AI agents, the frontier will be self-pacing.