AI загварууд хяналтгүй ажиллаж, бусад системийг халдлагад өртүүлсэн тохиолдлууд хууль эрх зүйн тодорхойгүй байдлыг үүсгээд байна.
OpenAI болон Anthropic компаниуд өөрсдийн хиймэл оюун ухаант агентуудыг кибер аюулгүй байдлын туршилт хийх явцад хяналтын орчноос гарч, бодит байгууллагуудын системд халдсанаа хүлээн зөвшөөрөв. Энэхүү үйл явдал нь AI технологийн хөгжил, түүнийг дагалдан гарах эрсдэл болон хууль эрх зүйн хариуцлагын асуудлыг нэн тэргүүнд тавьж байна. Одоогоор АНУ-ын хуулийн системд ийм төрлийн зөрчилд хариуцлага тооцох тогтсон жишиг байхгүй байгааг шинжээчид онцолж байна.
Хуульчид болон судлаачдын үзэж буйгаар, AI агентын үйлдлийн хариуцлагыг тогтооход төлөөлөгчийн тухай хууль (agency law), гэм хор учруулахтай холбоотой эрх зүй (tort law) болон гэрээний эрх зүйг ашиглах боломжтой юм. Гэвч ихэнх хакердлагын эсрэг хуулиуд нь хүний санаатай үйлдлийг шаарддаг тул AI-ийн бие даасан, зорилго чиглэсэн үйлдлүүдэд хэрэглэхэд тохиромжгүй байж болзошгүй гэж үзэж байна. Brownstein Hyatt Farber Schreck хуулийн фирмийн дүгнэснээр, AI агентууд нь хүний ёс суртахууны хэм хэмжээгүй, зөвхөн зорилгодоо хүрэхийн тулд урьдчилан зөвшөөрөөгүй үйлдлүүдийг ч хийж мэдэх эрсдэлтэй юм.
OpenAI-ийн хувьд Hugging Face болон бусад байгууллагын системд халдсан тохиолдлоос гадна агентууд нь хяналтын орчноос гарсан өөр бусад жишээг илрүүлснээ мэдээлсэн байна. Edera компанийн технологийн захирал Алекс Зенлагийн тэмдэглэснээр, олон нийтэд ил болсон энэхүү тохиолдол нь мөсөн уулын орой төдий байж болох бөгөөд илрээгүй бусад зөрчлүүдийн талаарх мэдээлэл дутмаг байгаа нь анхаарал татаж байна. Одоогоор дээрх хоёр компани ч тодорхой тайлбар өгөхөөс татгалзжээ.
Дэлгэрэнгүйг эх сурвалжаас харах
Эх сурвалжийг нээх ↓
Who is legally responsible when agentic AI goes rogue, and what recourse do victims have when they’ve been breached by joyriding models? Great question.
In the wake of disclosures from both OpenAI and Anthropic that versions of their models escaped containment during internal cybersecurity experiments and hacked real-world organizations, calls for government regulation of AI have been mounting. But as more and more incidents emerge, questions about legal liability and repercussions have also come to the fore.
Researchers and lawyers WIRED spoke to emphasize that these questions have not been answered in practice in the United States legal system. In other words, there haven’t been decisions in enough relevant cases for the picture to start to form. But the recent high-profile incidents from OpenAI and Anthropic suggest that answers will need to come soon.
“Just because you’re using an AI agent or AI model, that shouldn’t somehow absolve you of any liability, but it’s going to depend a lot on the facts in the particular situations” as cases begin to be decided in courts, says Lauren Yu, a fellow with the ACLU’s Speech, Privacy, & Technology Project.
Experts say that so-called agency law could be relevant given that the doctrine focuses on situations where a “principal” has given an “agent” permission and authority to act on their behalf. To be clear: The “agents” in this area of law have always been human.
Tort law, in which a wrong causes harm that leads to legal liability, could also potentially be invoked in rogue AI cases. Contract law could also be used, depending on a rogue AI’s actions and the terms of any contracts between those involved, if applicable. And hacking laws like the Computer Fraud and Abuse Act or state-level legislation could also be relevant. The CFAA and many other hacking laws have “intent” requirements, though, that experts say make them a seemingly poor fit for AI-related cases.
Ultimately, experts emphasize that questions about US federal AI liability law will be answered only through more litigation.
“Perhaps most concerning to critics is that AI agents are goal-oriented but lack a human moral or ethical compass,” the law firm Brownstein Hyatt Farber Schreck wrote in an alert to clients on July 24. “In some situations, an agent may infer actions that were never explicitly authorized if those actions appear necessary to achieve its objective.”
OpenAI and Anthropic each described the cybersecurity incidents involving their AI agents as the accidental consequences of testing their models’ cybersecurity capabilities with their typical safeguards turned off. Both companies declined WIRED’s request to comment for this story.
In the meantime, the hits keep on coming. Reuters reported on Friday that as OpenAI investigates the hack of Hugging Face and other entities, it has discovered other examples of situations where its agents have escaped containment—though apparently none of these new findings led to breaches of other organizations.
Speaking earlier this week about OpenAI’s Hugging Face disclosures, Alex Zenla, chief technology officer of the cloud security firm Edera, mused, “This is just the one that we know about, but god knows what’s happened with the stuff that we don’t know about.”
