Hacker News Reader

Comment by cperciva | Hacker News Reader

AI-enabled hacking

Do people get locked up for fatal traffic accidents? Do doctors get locked up if they prescribe a medicine which leads to a patient's death due to a side effect?

Criminal prosecution, in civilized countries, requires both Actus Reus and Mens Rea. If you deliberately commit computer crime using an AI system, you'll already be prosecuted; the cases we keep hearing about from AI labs have no human intent behind them.

The accepted solution to unintended harms is regulation: We have regulations about automotive safety, we have regulations about pharmaceutical testing and approval, etc.

View on HN

HN seems to have an incredibly poor understanding of what Mens Rea means or how it’s applied.

You don’t need someone to jump up, wave their arms and scream “I meant to do it!” to establish intent.

It can be established in any way deemed believable by a jury including repeating the same action that leads to a similar outcome multiple times.

It’s even been instructed to juries that they can find intent in the deliberate decision to not seek out the likely outcome of performing an action.

All civilized countries have the concept of gross negligence where you can be prosecuted for knowingly doing something that causes harm as a side-effect.

How do you establish deliberation with the lack of transparency? You can be deliberate by not prioritizing resources in regulations, safety, ethics, etc., especially after "rogue" instances happen. If anything, I am seeing them moving to the opposite direction [1] [2].

More instances are being disclosed [3] and what are they doing about it exactly? It's just a shameless marketing technique, and they will keep doing it until they are held accountable.

[1] https://edition.cnn.com/2026/10/08/tech/fired-open-ai-resear...

[2] https://news.ycombinator.com/item?id=49257160

[3] https://fortune.com/2026/10/16/openai-discloses-four-more-ro...

Drs can both go to prison, and be banned from practicing medicine if their actions (or inactions) lead to patient harm AND they violate the standards of their profession.

Right, because there are established standards.

We could establish standards

I do not practice law but to me the AI hacking looks like mens rea. Negligence or recklessness suffice.

It goes beyond negligence here, because Anthropic employees have stated on the record that they are making and deploying products which put people at risk. That is knowing and potentially willful, which would be the highest level of mens rea in the US.

If there is no mens rea there is still civil prosecution.

I think "deliberately" is really hard to prove because very few lawmakers have an understanding of how agentic large language models work

I would say pointing an "internal research" model at a task with zero monitoring clearly is deliberate behaviour. And the team involved should be prosecuted to the full extent of law.

What should be introduced in AI safety bills are clear ways of monitoring and curtailing model behaviour.

It is not hard to get an AI model to use an append only log and that can be cryptographically secured with PQ security. And we will know when a model is being deceptive.

Amen.

Reply on news.ycombinator.com