Leaky sandboxes and bursting reservoirs
28 August 2026
Strange are the ways in which AI can escape and do harm; equally strange are the curious mechanisms whereby water can escape and do harm.
Water
Let’s start in the 19th century with water, and one of the most famous cases of all time, Rylands v. Fletcher. Fletcher owned a mine, Rylands (of The John Rylands Library fame) a local cotton mill for which he needed water from a reservoir (for steam). The reservoir was excavated, and during the excavation five blocked vertical mineshafts were found in the bed of the reservoir. But two things were not known, namely that these vertical shafts had not been filled in very well, and also that they joined with lateral shafts leading to Fletcher’s mine (of which they had originally formed a part). After two separate escapes of water into the colliery in 1860 and 1861, the inspector of mines thought enough was enough, warned off Fletcher, who closed his mine down.
Fletcher sued Rylands, and won in the House of Lords, seven years after issue of his claim and a tortuous process through the courts. Liability was ultimately declared to be strict; Rylands did not have to know or be aware of the interconnections between his reservoir and Fletcher’s mine. For historical, technical and legal detail, see Professor A.W.B. Simpson in his superb article in the Journal of Legal Studies (vol.xiii, 1984, p.209). In short, there had been in recent memory two catastrophic reservoir bursts (78 dead in 1853, and 238 dead in the 1864 Dale Dyke breach shown in the contemporary image above), both involving municipal water supplies. The judicial atmosphere would have been such that it would be like deciding a new point of tort law about industrial explosions in the immediate aftermath of the Buncefield catastrophe in 2005. And yet the Rylands reservoir was a modest private enterprise, of such a volume that it would not even be regulated these days under reservoirs legislation. It exists, and Professor Simpson tells us that it was still leaking when he saw it.
As later cases such as Cambridge Water v. Eastern Counties Leather have clarified, liability is not that strict. Foreseeability of the relevant type of harm is necessary, but not of the mechanism by which it occurred. Lord Blackburn put it thus
“We think that the true rule of law is, that the person who for his own purposes brings on his land and collects and keeps there anything likely to do mischief if it escapes, must keep it at his peril, and, if he does not do so, is prima facie answerable for all the damage which is the natural consequence of its escape” (1866) L.R. 1 Ex.265, 279, Court of Exchequer Chamber.
In recent times, Rylands has become sidelined into a sub-category of private nuisance applicable to isolated escapes from land, rather than a broad authority for strict liability in tort. But it had its moment, albeit being out of synch with similar tort cases before and after it.
Escaping AI
Now to escapes of AI, and what happens when something wriggles out of its sandbox. Sandboxes are meant to keep developmental AI in. So, spool on 160 years. On 16 July 2026, an AI platform called Hugging Face told US law enforcement that an attacker had used an AI agent to breach its systems. But no human had been involved. Two OpenAI models (one released, one under development) had got out of their development sandbox and hacked Hugging Face.
More precisely, a sandbox for AI is an isolated computer environment with no internet access, except for an internal system designed to send in enough software to do no more that test the models. Its purpose is to insulate the AI models from the rest of the world. But these mischievous OpenAI models (i) exploited an unknown vulnerability in the intro/exit software, (ii) reasoned via the internet, to which they now had access, that the solutions for the problems they had been set was to be found at Hugging Face, and (iii) duly hacked it to get its answers, sending in a dataset which enabled the models to harvest login details and access internal servers. See, for the short version, Outside the Box , The Economist, July 25, 2026, p.73, for a longer an independent report by METR (of 26 August 2026) commissioned by OpenAI. The METR report contains a helpful graphic, suggesting that at its height the attack on Hugging Face involved 1200 AI agents working together via a shared message board which the agents had created.
This is just one of a series of recent episodes involving rogue agents which has been causing embarrassment to OpenAI and Anthropic, in particular.
Where would liabilities lie for these kinds of events? This question raises a whole host of problems, much chewed over the last few years. Is the AI agent (by it or its team) an agent in law of its owner? Is the owner vicariously liable for it? Is it potentially a case for strict liability? And, back to Rylands, is foreseeability of the relevant type of harm which occurred enough, or does the owner need such foreseeability of the mechanism of harm?
First, let us have a look at the position under English law – assuming that our claimant is a domestic Hugging Face and our defendant a domestic OpenAI. The starting point may be thought to be the law of negligence. On these facts, OpenAI may not have been negligent if the vulnerability in its own software was not reasonably evident to it – compare Fletcher’s lateral mine workings of which Rylands was unaware. Its case appears to be that OpenAI underestimated the cyber capabilities of its own models – which is slightly troubling as those models will doubtless get cleverer. Similarly, it might be said that the escape of the mischievous AI models in league to wreak havoc on Hugging Face may not have been foreseeable. But in each case, the resultant brouhaha may have made subsequent escapes negligent or foreseeable; Anthropic and OpenAI will know a good deal more about its agents’ capabilities than it did a few months ago.
In addition, there may be claims in trespass to goods (if the models interfered with Hugging Face’s property and information storage) and potentially, the accessing and/or disseminating of personal data from the victim’s systems, for misuse of private information. See e.g. the recent case of Al-Masarir v. Saudi Arabia [2026] EWHC 119 (KB) where Saudi Arabia was found liable in trespass to goods for deliberately infecting with Pegasus spyware mobile phones belonging to a vocal YouTube critic of the Saudi regime. There are no current cases on an unintentional act getting into a victim’s database which would otherwise amount to a trespass.
If needed, might there be room for a broader strict liability, with the courts fashioning a modified cause of action to plug what they perceived to be a gap in legal protection? An escaped AI agent capable of conspiring with other rogue agents is certainly something “likely to do mischief if it escapes”, in Lord Blackburn’s terms. In favour of this is the black box nature of AI, and hence the inability without more for a claimant to prove what went wrong and whether it amounts to negligence. Is a new regime is needed? I can see the case for it, but I think that this is unlikely. Most of the reported incidents are capable of giving rise to a claim in negligence, in which case judicial creativity will not be called upon, and the tort of trespass to goods, as and when tested, may fill in the gaps.
There is a qualified strict liability for products under the UK Consumer Protection Act 1987, but in this Act the definition of products does not include software, and it only benefits consumers, not businesses. But the UK CPA, deriving from EU legislation, is coming under UK Law Commission scrutiny, and one of the objects of their scrutiny may be this software point, as well as the EU’s post-Brexit revised Consumer Protection Directive (2024/3853). This EU Directive, still only applicable to consumers, does cover software, indeed any form of AI placed on the market or put into service after 9 December 2026. It also tries to mitigate the difficulties of proof in favour of a claimant by two provisions; Art.9, which requires a defendant to a plausible claim to disclose relevant evidence, and Art.10, which enables a presumption of proof if the defendants fails to disclose or the damage was caused by an obvious malfunction of the product. A Commission proposal (COM(2022) 496, to apply similar rules to all AI harm, not just that suffered by consumers, ran into institutional sand and was withdrawn in 2025.
But a claimant would still have to prove “defectiveness” under s.3 CPA or its equivalent in Art.7 of the new EU CPD. This is not a straightforward test for a claimant as it brings in some of the elements relevant to a claim in negligence. Which is why I described the CPA/CPD regime as qualified strict liability.
For a more detailed account of civil liabilities for AI, listen to LawPod UK’s Episode 236 on the UK Jurisdiction Taskforce draft Legal Statement on AI, or read the Final Version of that Legal Statement here.
AI general regulation
The EU is on the move in terms of AI general regulation. There is its all-encompassing Regulation 2024/1689, covering the placing on the market, putting into service, and the use of AI. Most of the Directive applied from 2 August 2026. The Regulation is enormously detailed (144 pp) but the provisions of Art. 57 caught my eye, given the sandboxes which feature above. Member States shall establish at least one AI regulatory sandbox each, to support innovation. This are principally for use in testing high-risk AI systems (no reason to have such a sandbox for a low-risk AI), but these high-risk AI systems may be tested by the developer outside those sandboxes but only after a host of onerous conditions (Art.60) are satisfied.
The UK has no specific regulatory system for AI. It relies on existing laws and regulation, including the Information Commissioner’s Office, Financial Conduct Authority and Ofcom. Forthcoming legislation was mentioned in the 2024 King’s Speech, but it has not emerged. Perhaps it will amend the CPA in line with the EU current Directive. But it may continue without an overarching regulatory structure.
