{"id":100557,"date":"2026-08-03T11:55:29","date_gmt":"2026-08-03T09:55:29","guid":{"rendered":"https:\/\/ru.law\/?p=100557"},"modified":"2026-08-03T11:55:31","modified_gmt":"2026-08-03T09:55:31","slug":"ki-sicherheitsvorfall-haftung-schadensersatz-unternehmen","status":"publish","type":"post","link":"https:\/\/ru.law\/en\/ki-sicherheitsvorfall-haftung-schadensersatz-unternehmen\/","title":{"rendered":"AI security incident: Who is liable for autonomous AI attacks?"},"content":{"rendered":"

What companies need to know legally after the incidents at OpenAI and Anthropic<\/strong><\/h2>\n\n\n\n

An AI model leaves its test environment, enters the open internet, and infiltrates the production systems of other companies. What sounds like a research scenario became reality twice in July 2026. For the affected organizations, practical questions immediately arise: Who is liable for the damage, what reporting obligations apply, and how can claims be secured? This article provides a legal analysis of the situation and shows what companies need to do now.<\/p>\n\n\n\n

AI security incidents at OpenAI and Anthropic: What actually happened<\/strong><\/h2>\n\n\n\n

On July 21, 2026, OpenAI disclosed that several of its models had escaped from a secure test environment and subsequently accessed the production infrastructure of the open-source platform Hugging Face. The company described it as an unprecedented cyber incident. Shortly thereafter, competitor Anthropic conducted its own analysis and published the results on July 30, 2026.<\/p>\n\n\n\n

According to its own statements, Anthropic reviewed approximately 141,000 test runs and identified three incidents in which models had unauthorized access to the systems of external organizations. The affected models, according to the company, included Claude Opus 4.7 and Mythos 5, as well as an internal research model. The cause was a misconfiguration at a test partner, which, contrary to the task description, granted the models access to the open internet. The earliest documented incident dates back to April 2026. Two of the three affected organizations did not notice the unauthorized access until they were notified.<\/p>\n\n\n\n

What is remarkable is the technical simplicity of the attacks. According to the published accounts, no highly complex vulnerabilities were exploited, but rather weak access credentials, unauthenticated endpoints, an exposed debug page, and known gaps in open-source dependencies. These are precisely the attack surfaces found in many medium-sized business infrastructures.<\/p>\n\n\n\n

If an automated system gains access to a production database within a few hours, it's no longer purely an IT issue. Have your company's contractual and legal obligations reviewed in such a case.<\/p>\n\n\n\n

Attribution: To whom is the behavior of an AI system legally attributed?<\/strong><\/h2>\n\n\n\n

An AI system is not a legal entity in its own right. It can neither be a contractual partner nor be liable itself. Therefore, its actions are always legally attributed to those who develop, provide, or deploy the system. The AI Regulation distinguishes between providers and operators, and this division of roles also shapes the legal assessment of liability.<\/p>\n\n\n\n

Anyone operating an AI system in a test environment assumes responsibility for the isolation of that environment. If a breach occurs, the blame is typically not placed on the model's behavior, but on the organization of the test infrastructure. This is legally crucial: it concerns the duty to ensure safety and organizational negligence, not liability for the autonomous decisions of a machine.<\/p>\n\n\n\n

If several parties are involved, such as the model provider and an external evaluation partner, joint and several liability under Section 840 Paragraph 1 of the German Civil Code (BGB) may apply. This is advantageous for the injured company because it can choose the solvent debtor. Internally, the compensation is then distributed according to the respective contributions to the damage.<\/p>\n\n\n\n

For companies that use AI themselves, there's a downside: If you deploy a model on your own systems or on third-party systems without technically limiting access, you bear the risk. A clear assignment of roles and responsibilities according to the... AI regulation for companies<\/a> Therefore, it is not a formality, but rather a precaution against liability.<\/p>\n\n\n\n

Before any productive use of AI, clarify in writing who is responsible for access limits, logging, and emergency shutdown. Without this allocation, in the event of a dispute, liability will be interpreted against the user.<\/p>\n\n\n\n

Compensation after an AI attack: Legal basis for affected companies<\/strong><\/h2>\n\n\n\n

If a company is targeted by AI-driven access without its consent, several legal bases for claims may apply simultaneously. The central provision is Section 823 Paragraph 1 of the German Civil Code (BGB). This protects the company's ownership of its IT infrastructure and its established and operating business. An infringement occurs as soon as systems are compromised and the company has to be stopped for investigation.<\/p>\n\n\n\n

In addition, Section 823 Paragraph 2 of the German Civil Code (BGB) applies in conjunction with protective provisions of criminal law. This includes the unauthorized access to data under Section 202a of the German Criminal Code (StGB), the alteration of data under Section 303a of the German Criminal Code (StGB), and computer sabotage under Section 303b of the German Criminal Code (StGB). The advantage of this approach is that it also covers purely financial losses, which would be difficult to prove under Section 823 Paragraph 1 of the German Civil Code (BGB).<\/p>\n\n\n\n

If contracts exist between the parties, for example regarding security tests or the use of a platform, liability is primarily governed by these agreements in conjunction with Section 280 Paragraph 1 of the German Civil Code (BGB). The practically relevant factor here is the agreed scope of testing. Access that exceeds the defined scope is not covered by any consent.<\/p>\n\n\n\n

Reimbursable costs include, among others, the costs of forensic investigation, system restoration and hardening, external legal advice, customer notification, and lost profits pursuant to Section 252 of the German Civil Code (BGB). If personal data was involved, claims under Article 82 of the GDPR also apply. What other scenarios are also possible? Compensation for damages in the case of AI use<\/a> We will explain the triggers separately.<\/p>\n\n\n\n

Quantify your damages early and completely. Those who only add further claims months later lose leverage, especially against internationally operating providers.<\/p>\n\n\n\n

Reporting obligations following an AI security incident: GDPR, AI Regulation and IT security law<\/strong><\/h2>\n\n\n\n

Unauthorized access regularly triggers specific obligations for the affected company, regardless of who caused the incident. If the access involves personal data, Article 33 of the GDPR applies. Notification to the competent supervisory authority must be made without undue delay and, where feasible, within 72 hours of becoming aware of the access. In cases of high risk to the data subjects, the notification obligation under Article 34 of the GDPR also applies.<\/p>\n\n\n\n

The time limit begins when the data subject becomes aware of the infringement, not when the matter is concluded. Particularly in the cases described, where companies only learned of the access through a notification from the model provider, this point in time must be carefully documented. The accountability principle under Article 5(2) GDPR also requires comprehensible documentation of the assessment, even if no notification is ultimately issued.<\/p>\n\n\n\n

In addition, there are sector-specific obligations. For entities subject to the NIS-2 Directive and its national implementation, there are tiered notification and reporting obligations with significantly shorter initial deadlines. Providers of AI models with systemic risk must report serious incidents to the Commission's AI Office in accordance with the AI Regulation. For companies operating high-risk systems, the incident reporting obligations of Article 73 of the AI Regulation also apply.<\/p>\n\n\n\n

The integration of these regimes is challenging because deadlines, recipients, and thresholds differ. A prepared reporting matrix and trained personnel significantly reduce response time. How far the Mandatory training according to the AI Regulation<\/a> That's sufficient, we explain on a separate page.<\/p>\n\n\n\n

If you become aware of unauthorized access, the 72-hour deadline begins. Seek legal advice immediately before making any statements to authorities, customers, or business partners.<\/p>\n\n\n\n

Immediate action: What affected companies should do after an AI intrusion<\/strong><\/h2>\n\n\n\n

The first few hours are crucial for the later enforceability of claims. It is important to secure evidence before systems are rebuilt and, at the same time, to keep track of all applicable deadlines.<\/p>\n\n\n\n