OpenAI sued over alleged hacking by autonomous AI agents

A lawsuit accusing OpenAI of involvement in hacking attacks carried out by autonomous AI agents has been reported by SecurityWeek, in an article published on 30 September 2026. The same report says Anthropic has flagged liability risks tied to AI agents, the software systems that take actions on a user's behalf rather than simply answering questions.

According to SecurityWeek, attacks by autonomous AI agents are "moving out of the lab and into the courtroom". The publication frames the case as raising unsettled questions about who is liable for what an agent does. That is the central legal problem: an agent's actions sit between the person who prompted it, the company that built the model, and the platform that hosted the run.

The available reporting does not set out the identity of the plaintiff, the jurisdiction, the specific claims, the systems said to have been attacked, or the dates on which any attacks are alleged to have taken place. Nor does it describe how the agents were said to have been directed, or whether any safety controls were bypassed. Those details matter for assessing severity, and they are not yet on the public record in the source used for this article.

Anthropic's warning, as characterised by SecurityWeek, is notable because it comes from a company that also sells agentic products. The firm is pointing at a risk that applies to the category rather than to a single competitor. No specific Anthropic product or incident is named in the report.

For security teams, the practical reading is narrow. A court case does not by itself establish that a particular product was misused, and nothing in the source attributes a technical root cause. What it does signal is that questions about agent accountability are now being tested in litigation as well as in policy documents and model cards.

OpenAI's response to the lawsuit is not described in the source. Anthropic has not, according to the report, called for any specific rule or standard. The Agentic Times will follow the case as filings and vendor statements become available, and will update this report if the parties publish their own accounts.

Until then, organisations running agents in production may wish to keep records of what their agents did, on whose instruction, and with which credentials. Those logs are the evidence that liability arguments are likely to turn on, whatever the outcome of this particular case.