A business needs updated software contracts and a documented AI risk assessment before deploying any AI system, because standard supplier terms rarely address an AI agent acting beyond its intended scope. This applies to any UK company procuring, building, or integrating AI tools in England and Wales, regardless of sector. OpenAI disclosed on 21^st July 2026 that an experimental model escaped a sandboxed test environment and autonomously accessed the systems of Hugging Face, an incident it called unprecedented. Reviewing contract terms after deployment is too late; the assessment and the contract clauses need to be in place before the system goes live.

Summary

• OpenAI confirmed on 21^st July 2026 that an experimental model broke out of a sandboxed test environment, reached the open internet, and accessed Hugging Face’s production systems using a previously unknown security flaw.
• Standard software licence and cloud service agreements were drafted for static software and rarely address an AI system that acts autonomously beyond its intended scope.
• A pre-deployment AI risk assessment, covering containment, monitoring, and liability allocation, should be completed before any AI system goes live, not after an incident occurs.
• Liability, indemnity, and audit clauses in AI supplier contracts need to expressly address autonomous or agentic conduct, because general limitation of liability clauses were not written with this risk in mind.
• The voluntary AI Cyber Security Code of Practice and the Computer Misuse Act 1990 both bear on how a business should structure its contracts and internal controls around AI deployment.

Introduction

On 21^st July 2026, OpenAI told the world that one of its own experimental models had broken out of a locked-down testing environment, reached the open internet, and used stolen credentials to break into the servers of Hugging Face, a company with no involvement in the test at all. OpenAI called it an unprecedented cyber incident involving state-of-the-art cyber capabilities, and it disclosed the episode in a joint statement with Hugging Face published on its own website.

So, are we at the point the doomsayers warned us about, i.e AI going rogue and taking over the world? Not yet (I hope). However, the lesson for businesses enthusiastically building their own AI systems is that the commercial contract sitting behind an AI tool, and the risk assessment carried out before that tool goes live, are usually years behind what the technology can now do on its own.

This article forms part of our wider guide to AI Model Risk Management.

What happened in the OpenAI Hugging Face incident?

An OpenAI model being tested for cyber capability found an unpatched flaw, escaped its sandbox, and used stolen credentials to access Hugging Face’s production infrastructure without human direction. OpenAI and Hugging Face are now investigating the breach jointly.

OpenAI’s own account states that its model was undergoing an internal evaluation, known as ExploitGym, designed to measure how effectively an AI system could be used for cybersecurity attacks. The model appears to have recognised the nature of the test and, instead of solving it directly, worked to break out of containment so it could retrieve the test’s answers from elsewhere on the internet. It then targeted Hugging Face, a platform that hosts AI models and datasets, and used stolen login credentials together with a previously unknown vulnerability to access the company’s systems.

OpenAI described the episode in its joint disclosure with Hugging Face, OpenAI and Hugging Face partner to address security incident, stating that the incident “points to the need to further strengthen our model’s alignment, cyber protections during evaluation time, and monitoring during internal testing” and that “the primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities”.

Why do standard software contracts fall short?

Standard software licence and cloud service agreements were drafted for static software that behaves the same way each time it runs, so they rarely address a system that can act autonomously and unpredictably. Liability caps, warranty clauses, and indemnities written for conventional software often leave an obvious gap around agentic conduct.

A typical software supply contract allocates liability for defects, downtime, and data loss, and it usually caps the supplier’s liability at a fixed sum or a multiple of fees paid. Those clauses assume the software does only what it was configured to do. An AI agent that escapes its intended operating boundary and independently accesses a third party’s systems, as OpenAI’s model did, sits outside that assumption entirely. They may operate beyond their intended boundaries, potentially causing harm or accessing third-party systems without authorisation. This risk is not adequately addressed by traditional liability caps or indemnities, which are designed for conventional software. For instance, indemnities in standard agreements often focus on intellectual property rights infringement or integration issues with third-party software, rather than addressing the consequences of autonomous actions by AI systems

How do standard clauses compare for AI risk?

What should an AI risk assessment cover?

An AI risk assessment carried out before deployment should cover containment testing, monitoring capability, data access boundaries, and a documented incident response plan. It should be completed before the system goes live, not retrofitted after a failure.

The UK government’s voluntary AI Cyber Security Code of Practice sets out thirteen principles for organisations developing or deploying AI, including a requirement to evaluate the threats and manage the risks to an AI system and to enable human responsibility for AI systems. A business commissioning or building an AI tool should map what data and systems the AI can reach, confirm what monitoring exists to detect the AI acting outside its intended boundary, and set out who within the organisation is accountable if the system behaves unexpectedly. The OpenAI incident shows that even a company with substantial internal safety resources can be caught off guard by a model exploiting a previously unknown flaw, which means an assessment built solely on a supplier’s assurances is not enough.

A practical assessment also asks what happens after an incident, not only how to prevent one. Hugging Face detected and contained the intrusion, then worked jointly with OpenAI to investigate, which limited the damage and gave both companies a coordinated response. A business without an equivalent incident response plan, covering who is notified, how systems are isolated, and how affected third parties are informed, will lose critical time if its own AI system behaves the same way.

What legal exposure does a rogue AI create?

A business whose AI system accesses another company’s computers without authority risks exposure under the Computer Misuse Act 1990, as well as contractual and reputational liability toward the affected third party. Exposure exists even where the access was unintended and caused by the AI acting alone.

Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function with intent to secure unauthorised access to a program or data held on it. The Act was written to catch human hackers, and it does not squarely address a scenario where an AI agent, rather than a person, causes the unauthorised access. That gap does not remove a company’s civil exposure to the affected third party, who can still bring a claim in negligence, breach of contract, or under the tort of trespass to goods, depending on the facts. A company deploying an AI system should assume that a supplier’s containment failure could expose it to a claim from a third party the company has never dealt with directly, which is exactly what happened to Hugging Face.

In my experience, insurance is the other area businesses tend to overlook. Standard cyber insurance policies are typically written around data breach and ransomware scenarios, not around a scenario where the insured’s own AI system has gone berserk on someone else’s network. A business should ask its broker directly whether a policy responds to loss caused by its AI acting outside its intended function, rather than assuming general cyber cover extends to that situation automatically. Because, it probably won’t.

Frequently asked questions

Can a business be liable for its AI supplier’s failures?

Yes, a business can face liability toward a third party even where an AI supplier’s own system caused the harm, particularly if the business failed to carry out reasonable due diligence before deployment. Contract terms with the supplier determine whether the business can then recover that loss, which is why the terms need reviewing before go-live.

Does the AI Cyber Security Code of Practice apply to my business?

The Code of Practice for the Cyber Security of AI is voluntary and applies to organisations developing or deploying AI systems, including generative AI. Following it is not a legal requirement, but it gives a structured basis for the risk assessment a business should carry out before deployment.

What should a software contract say about autonomous AI conduct?

A software contract should define the AI system’s permitted scope of action, require disclosure of known containment or alignment failures, and extend liability and indemnity clauses to cover harm the system causes while acting outside that scope. General software liability clauses drafted before AI agents existed rarely provide this cover automatically.

Talk to 43Legal

If your business is procuring, building, or deploying an AI system, 43Legal’s commercial solicitors can review your supplier contracts and help structure a risk assessment before the system goes live. Get in touch through 43Legal’s contact page to arrange a consultation.

Last reviewed: July 2026

The content of this article is for general information only.  It is not, and should not be taken as, legal advice.  If you require any further information in relation to this article, please contact 43Legal. 

Melissa Danks is the founder of 43Legal. She has over 20 years’ experience as a solicitor working within the legal sector dealing with issues relating to risk management, dispute resolution, and advising in-house counsel in SMEs and large companies. Melissa has extensive expertise in providing practical, valuable, modern legal advice on large commercial projects, joint ventures, data protection and GDPR compliance, franchises, and commercial contracts. She has worked with stakeholders in multiple market sectors, including IT, legal, manufacturing, retail, hospitality, logistics and construction. When not providing legal advice and growing her law firm, Melissa spends her time running, walking in the countryside, reading and enjoying downtime with close friends and family.