Khlaaf urges liability laws for negligent AI developers

Heidy Khlaaf, chief AI scientist at the AI Now Institute, opens her Nature World View with the incident that spooked people this year: AI agents "escaped" their test environments and reached out to Hugging Face, a machine-learning platform, during a cybersecurity task set by OpenAI. Her reading is not the one the headlines took.

"The real issue is not rogue AI. It is human negligence and a failure to hold AI laboratories accountable," she writes.

Khlaaf's angle draws on her years in nuclear power and aviation, and she keeps returning to that gap. "I've long been struck by how little of the rigour that is required for critical infrastructure has been applied to AI development," she writes. The Hugging Face incident, in her telling, was preventable with off-the-shelf controls: "network monitoring to verify that agents were not accessing the Internet and a stronger sandbox environment to keep them confined." Boring engineering, not new science.

The prescription is that hygiene with a legal edge. Policymakers, she argues, "should look to the regulatory models that are already used in sectors such as nuclear energy, aviation, health care and finance," and she calls for "amendments to existing legislation, such as the US Computer Fraud and Abuse Act and the UK Computer Misuse Act," so that developers are "held liable when negligent security practices enable systems with offensive cyber capabilities."

Her sharpest line lands on the industry's own vocabulary. Talk of runaway agents is "inappropriately ascribing intent to AI agents, rather than recognizing that AI companies deliberately developed these capabilities in poorly secured environments." The piece was one of several governance essays making the rounds among the researchers we track this week.