Advanced AI Is Ultrahazardous. Let’s Treat It That Way

The fallout from the OpenAI hacks continues to spread. Over the weekend, Reuters reported that OpenAI did not realize it was responsible for the Hugging Face breach until nearly a week after it happened, and after Hugging Face had contacted the FBI. And on Tuesday, after additional reporting from Reuters, OpenAI disclosed that several additional public services were breached. So far, the reported data compromise was fairly benign—answers for an exploit benchmark. But it isn't difficult to imagine more sensitive targets being hit, or more sensitive data being exfiltrated. Perhaps it's already happened. Just last week, the UK’s AI Security Institute reported that during a cyber capability evaluation, one model attempted to breach AISI’s evaluation infrastructure to find answers to an impossible benchmark. And in November of last year, Anthropic disclosed that state-sponsored hackers had used Claude in an attempt to compromise American government systems.

While the OpenAI incident has renewed debates about the speed of AI development, existential risk and the national security implications of increasingly sophisticated large language models, one much more basic question has been left unanswered: when models go awry, who should pay?

Here, the American tort system already offers a ready-made framework for answering it: ultrahazardous activities.

Most tort liability in the US arises from negligence: failure to take reasonable, appropriate measures to prevent (or mitigate) a harm. But for some activities, this isn't enough: a significant, serious risk of harm may remain even if everyone is exercising reasonable care. Take dynamite blasting: it is necessary for tunnels and mines, but includes an unavoidable risk that debris will end up somewhere unexpected. Or handling nuclear waste: it is unavoidably hazardous, even when every precaution is taken.

For these and other ultrahazardous (also called abnormally dangerous) activities, defendants are held to a different standard: strict liability. Here, it does not matter which precautions were taken, or how careful the defendant was. In general, the defendant is simply liable for the harm that results from their activities.

Here's one story of advanced large language models, as told by the people who make them. The models are rapidly becoming more capable in cybersecurity tasks, including exploiting security vulnerabilities to compromise a system (or testing sandbox). This capability is enhanced (but not solely driven) by specific training in cybersecurity tasks. And while guardrails are possible, they are bound to be imperfect: the inherent sharp edges of a complex non-deterministic system that takes unstructured input, in a field that is evolving rapidly.

Or, to put it more plainly: advanced AI creates some degree of risk to digital infrastructure that cannot be fully mitigated. So why shouldn't it be designated an ultrahazardous activity?

The OpenAI case is a perfect example: an advanced model was tested with few safeguards. The result was at least four breaches and counting, and OpenAI wasn't even aware of its involvement until nearly a week later. As companies and governments continue to experiment with long-running agents, more such incidents are inevitable.

An ultrahazardous regime might hold a hosting provider and a model user jointly and severally liable for harm that results from testing or using an AI model. While traditional negligence might force judges and juries to decipher cutting-edge research to determine what reasonable care or responsible product design might look like, an ultrahazardous regime dispenses with all of that. And more than voluntary convenings, stiff financial penalties might better incentivize the development of better safeguards, while keeping AI companies from socializing their costs.

It is a matter of time before someone tries to make this case in court: perhaps for a data breach, or perhaps for a scam that depends in part on cloud-hosted inference. It isn't a slam-dunk: traditionally, ultrahazardous activities are identified based on the risk of physical harm—injuries and property damage—instead of financial loss and data theft. But it isn't outrageous to imagine the doctrine stretching to fit, especially in cases where cyber risks cross over to physical harm. And because tort law is a creature of state law, this may offer an easy model for state legislatures to take action, instead of being paralyzed by the speed of research and the frantic tenor of any discussion that involves AI.

A proposal like this may seem overly modest, or even quaint. It doesn't soothe angst about existential risk, nor does it hold off a rapidly developing present where AI is a core part of warfare. But not every law needs to be momentous and world-changing; it only seems that way when legislatures appear so incapable of basic action. And in a world where large AI models are used for mundane corporate work and occasionally end up hacking infrastructure and scamming ordinary people, this is a puzzle piece that makes sense.