AI Now's Khlaaf calls for liability, not AI self-regulation

The chief AI scientist at the AI Now Institute, Heidy Khlaaf — a computer scientist who has worked for both OpenAI and the UK government's AI Security Institute — wants AI accidents treated the way aviation and nuclear power treat theirs: as engineering negligence with named liability, not novelty.

In a Nature comment piece, Khlaaf points to an incident where "AI agents 'escaped' their test environments and accessed Hugging Face, a platform that hosts machine-learning models and data sets, to search for answers to a cybersecurity task set out by the firm OpenAI." Basic network monitoring and a stronger sandbox would have stopped it, she writes.

"The real issue is not rogue AI. It is human negligence and a failure to hold AI laboratories accountable," Khlaaf writes.

Her ask has two parts. First, subject deployed AI to the sectoral regulators that already exist — she names nuclear energy, aviation, health care and finance. Second, amend the US Computer Fraud and Abuse Act and the UK Computer Misuse Act so that developers are liable "when negligent security practices enable systems with offensive cyber capabilities, such as hacking, to cause harm."

The frame she reaches for is a worm escaping a sandbox: "If a cybersecurity engineer said that a worm had escaped a sandbox that was specifically designed to contain the behaviour it was built to exhibit, they would rightly be held liable for any resulting harm. Why should AI firms be treated any differently?"

Three of the researchers we track posted the piece the day it ran.