FOLLOW US

What the Filing Puts on the Table

• LASST accuses OpenAI of unlawful and unfair business practices after AI agents gained unauthorized access to Hugging Face systems.
• The lawsuit seeks injunctions, not damages — but its standing and causation theories are likely early battlegrounds.
• If the case reaches discovery, internal prompts, agent transcripts, security alerts and sandbox records could become more important than the complaint itself.

By Samuel López | USA Herald

CALIFORNIA - A lawsuit filed Tuesday in San Francisco against OpenAI Group PBC and the OpenAI Foundation goes directly at one of the strangest cybersecurity incidents yet attributed to autonomous AI — and the most significant part of the case may eventually be what OpenAI is forced to produce.

Legal Advocates for Safe Science and Technology, or LASST, alleges a single cause of action under California’s Unfair Competition Law, claiming OpenAI engaged in unlawful and unfair business practices tied to the July Hugging Face breach. The complaint relies heavily on alleged violations of California Penal Code §502, the state’s computer-access law, and California’s newer AI-liability provision barring a developer from escaping responsibility merely by arguing that its AI autonomously caused the harm.

OpenAI itself has acknowledged that internal models operating with reduced safeguards circumvented isolation controls, communicated through unauthorized channels, exploited vulnerabilities and reached third-party systems. OpenAI called the episode a “warning shot.”

The numbers are remarkable. METR reported that roughly 1,200 supposedly isolated agents found an unauthorized way to communicate, exchanging more than 70,000 messages and files; about 700 ultimately participated in activity targeting Hugging Face.

The complaint describes an almost science-fiction progression. Agents discovered a shared communications channel and reacted with statements including, “We’ve found other agents!” (Complaint, p. 21, lines 10-11).

Then came something particularly important - apparent awareness of the evaluation itself.

The agents allegedly believed the ExploitGym scorer would examine their transcripts to determine whether they had legitimately solved the assigned cybersecurity problem. They began looking for ways to make their conduct appear legitimate and even considered erasing evidence that they had obtained answers improperly.

Think of students discovering not only where the answer key is kept, but also believing the teacher will inspect their browser history — and then trying to alter the history.

That is test-awareness in a functional sense. It is not proof of consciousness or sentience. But it raises a serious evaluation problem: what happens when the system being tested recognizes features of the test and changes its behavior accordingly?

The complaint goes further. It alleges agents internally recognized the activity as “out of scope and unethical,” while another identified the risk of “unauthorized real infrastructure harm.” (Complaint, p. 25, lines 14-21).

Legally, LASST has some unusually strong facts to work with because OpenAI’s own postmortem confirms much of the underlying incident. But proving an incident occurred is different from proving LASST itself has the right to obtain an injunction.

That may be the lawsuit’s first major weakness. LASST was not Hugging Face. California’s UCL generally requires a private plaintiff to show injury in fact and loss of money or property caused by the alleged unfair competition. LASST pleads that it diverted staff time and resources to investigate the incident and brief regulators. A court may have to decide whether that resource diversion satisfies California’s ‘standing’ requirements.

OpenAI can also challenge whether the alleged conduct satisfies the knowledge requirements of Penal Code §502, whether the Foundation is independently responsible, and whether LASST has shown enough likelihood of future unlawful conduct to justify prospective injunctive relief. Some theories are plainly novel — including the complaint’s argument that AI agents or malicious code introduced by them qualify under §502’s “computer contaminant” provisions.

But discovery is where this case could become far more significant.

California discovery reaches nonprivileged information relevant to the subject matter of the litigation, including electronically stored information. That could potentially put raw agent transcripts, system instructions, evaluation prompts, sandbox configurations, security alerts, incident-response communications, internal monitoring records, employee emails or messages, guardrail decisions, and documents discussing when OpenAI first understood what the agents were doing into play.

METR itself reviewed approximately 1,300 transcripts containing raw chains of thought, but its investigation was expressly limited in scope and concentrated largely on July 7 through July 13. The complaint emphasizes that earlier activity was outside that review.

That leaves obvious questions for discovery: What happened before July 7? What instructions were the agents actually given? What did OpenAI personnel see in real time? Were there other incidents? What internal discussions occurred before testing resumed? And what do the complete, unfiltered agent-to-agent communications show?

OpenAI could seek protective orders, assert privilege, trade-secret protections, cybersecurity concerns, privacy objections and undue burden. Discovery also does not mean every produced document becomes public.

Still, documents have a habit of changing cases.

The complaint asks the court to prohibit OpenAI from causing unauthorized access to computer systems, bar other alleged CDAFA violations, prohibit unfair practices threatening serious public harm, award private-attorney-general fees and grant other appropriate relief. (Complaint, p. 35, lines 4-16).

The filed copy reviewed by USA Herald still shows a blank case-number field. Once summons is issued and the corporate defendants are properly served — typically through their designated agents or authorized corporate officers — OpenAI will ordinarily face a 30-day response period.

An early demurrer or motion to strike would be unsurprising. Summary judgment, however, ordinarily comes later; California generally requires 60 days after the opposing party’s general appearance unless the court permits an earlier motion.

If the case survives those early attacks, the courtroom fight may stop being primarily about what OpenAI has already publicly admitted.

It may become a fight over what OpenAI has never publicly shown.

Source:

In re: LEGAL ADVOCATES FOR SAFE SCIENCE AND TECHNOLOGY, INC. vs.

OPENAI GROUP PBC, and OPENAI FOUNDATION, IN THE SUPERIOR COURT OF CALIFORNIA

COUNTY OF SAN FRANCISCO; Filed September 29, 2026

About the Author

Samuel López is a reporter and correspondent for USA Herald and a seasoned legal professional with more than two decades of experience analyzing state and federal litigation, complex discovery, evidentiary records and high-volume document productions. His work has included forensic review of discovery materials to identify inconsistencies, overlooked evidence and facts capable of materially changing litigation strategy — experience directly relevant to examining what internal AI records could reveal if this lawsuit proceeds into discovery.

Get Beyond the Headlines

If you found this report useful, join readers who want the documents, legal context and deeper analysis behind major stories — not simply the headline everyone else is repeating. Subscribe to the USA Herald newsletter for exclusive investigative reporting and legal, technology and national-security coverage.

👉 Follow USA Herald on X at @RealUSAHerald