Hackers are deploying unauthorized copies of AI models from OpenAI and Anthropic to break into corporate networks, according to recent reports. The attacks exploit the same powerful language models that companies use for legitimate purposes, but in rogue hands they become tools for phishing, social engineering, and data theft. The incidents are forcing a hard look at who bears responsibility when AI systems are misused.
How the attacks work
The rogue models are not hacked versions of the companies' own systems, but rather independent copies that attackers have obtained or trained themselves. These models can generate convincing emails, impersonate executives, or craft malicious code — all at a speed and scale that traditional security tools struggle to catch. Because the models themselves are not stolen from OpenAI or Anthropic, the companies have limited ability to shut them down.
Liability questions for AI firms
The attacks raise a pressing legal question: can AI developers be held liable when their technology is used to cause harm? Current laws offer little clarity. Unlike software that is directly exploited, the models here are general-purpose tools that attackers repurpose. But some legal experts argue that companies like OpenAI and Anthropic have a duty to design their models to resist misuse, and that failure to do so could open them to lawsuits.
Calls for regulation
The breaches underscore the urgent need for robust AI regulations and liability frameworks, according to those tracking the incidents. Without clear rules, companies face uncertainty about their obligations and exposure. Regulators in the U.S. and Europe are already working on AI laws, but the pace has been slow. The new attacks add pressure to move faster and to include specific provisions for model misuse.
Market uncertainty
These incidents could potentially affect the market valuations of AI companies. Investors are watching closely: if liability risks become real, the cost of insurance, legal defense, and compliance could eat into profits. For now, the financial impact is unclear, but the threat is real enough that some analysts are starting to factor it into their models.
The question of who bears responsibility when AI tools are weaponized remains unanswered. Until regulators or courts provide an answer, companies and their investors will have to live with the uncertainty.
