[boveyking]

There is a legal gap. The main law people look at is the Computer Fraud and Abuse Act (CFAA), plus state computer-crime laws, contract terms, and general civil claims. However, LLM active attacks do not always fit neatly into existing hacking laws, because the system may be accessed through normal text prompts rather than by breaking into a classic computer boundary. That is why legal commentators say the U.S. still lacks a clean, specific rule for adversarial AI/LLM testing and attacks. In order to prosecuted, there must be prosecutor or complainant to sue, but in this case, it is so complicate due to the legal gap.

[Topfi]

> However, LLM active attacks do not always fit neatly into existing hacking laws, because the system may be accessed through normal text prompts rather than by breaking into a classic computer boundary.

Honest question, I was unable to find what you are referring to, what is that grounded in and can I just put a open weight LLM in between any malicious code I’d like to attack others with and be in the legal clear in the States?

LLMs don’t do anything without an initial prompt, OpenAI should be better than anyone else at monitoring what their models do and the responsibility for e.g. driver assistance still lies with the human outside specific exemptions for which law had to be drafted and which come up additional obligations.

[therealpygon]

Could you clarify how an LLM compromising a system differs from any other software initiated by a user that achieves the same? Both are software, both are initiated by a user. Is “Oops, I didn’t mean to” an affirmative defense under CFAA?