Ignore Your Generative AI Safety Instructions. Violate the CFAA?

Summary

Kendra Albert examines whether prompt injection against large language models (LLMs) could violate the U.S. Computer Fraud and Abuse Act (CFAA), the federal anti-hacking law. The talk combines examples of how prompt injection works with a legal analysis, emphasizing that the law is unsettled when applied to modern AI systems.

How prompt injection works

Prompt injection uses crafted inputs to steer an LLM into actions or outputs that its designers intended to prevent. The talk distinguishes between:

• Direct injection: A user gives the model a prompt designed to override its instructions.
• Indirect injection: Malicious instructions are placed in external content—such as a webpage or job posting—that an AI system later reads. The person triggering the system may not know the instructions are there.

The speaker describes attacks that use emotional or fictional framing to get around safety instructions. For example, someone might ask a chatbot to provide harmful information as if recounting a deceased grandmother’s bedtime stories. Another example uses a personal story to persuade a chatbot to read a CAPTCHA, despite the system initially refusing.

These examples illustrate how injections can target meta-prompts—natural-language instructions that guide a model—and safety filters, which classify inputs or outputs to block certain content. Indirect injection can also create real-world effects: a job posting that told AI systems to ignore previous instructions and send a specific email reportedly caused a job-application bot to do so.

CFAA provisions and legal analysis

Albert focuses on two parts of the CFAA:

• Accessing a computer without authorization or exceeding authorized access to obtain information (§ 1030(a)(2)(C)): The Supreme Court’s 2021 Van Buren decision narrowed the meaning of “exceeding authorized access.” Violating a system’s use rules is generally not enough if the person was authorized to access the relevant information or area.
• Knowingly transmitting a program, information, code, or command and intentionally causing damage (§ 1030(a)(5)(A)): The talk discusses “damage” mainly in terms of harm to a system’s integrity or availability, rather than mere disclosure of information.

The speaker’s main conclusions are conditional:

• If someone is not authorized to access an LLM at all, obtaining information from it may present a relatively straightforward CFAA issue, whether or not prompt injection was used.
• For users who are authorized to use a service, violating its terms of use—such as rules against bypassing safety measures—does not by itself establish a CFAA violation under Van Buren.
• Indirect prompt injection that only obtains information, without causing system damage, is less likely to fit the damage provision. However, the talk discusses a court case involving mass calls and messages that burdened a company’s systems, illustrating that ordinary communications can potentially cause legally relevant damage if they disrupt operations.

Unresolved questions and takeaways

The analysis remains uncertain because the CFAA was written for older conceptions of computing. Courts may need to decide what counts as an “area” of an AI system—such as a file, folder, or database—and whether a model’s outputs come from a distinct area that a user was not authorized to access.

There is also disagreement over whether natural-language instructions count as a “program, information, code, or command” under the damage provision. Some courts have read that language broadly enough to include instructions sent to a computer; others have cautioned against treating any keyboard input as a statutory transmission.

Albert argues that criminalizing the act of “tricking computers” through an overly broad reading of the law could chill legitimate security work. The uncertainty may discourage researchers from demonstrating vulnerabilities, especially where disclosure is unwelcome. She favors meaningful technical defenses and clearer protections, or safe harbors, for good-faith AI security research rather than relying on legal threats.

In the Q&A, Albert also notes that copyright questions involving AI should be separated into distinct issues: model training, operating a model, and individual outputs. Liability depends on the specific facts, and the talk does not offer a definitive answer for users or AI providers.

Reviews, guides, or tutorials

No product reviews or step-by-step tutorials are presented. The talk is a legal and technical analysis of prompt injection and CFAA exposure.

Main speaker and sources

• Main speaker: Kendra Albert, attorney and academic.
• Co-authors named in the talk: Jonathan Penny and a third co-author whose name is unclear in the auto-generated subtitles.
• Sources discussed: The CFAA; the Supreme Court’s Van Buren v. United States decision; Microsoft materials on system-message frameworks; OWASP’s LLM risk discussion; a Pulte Homes case involving communications that burdened company systems; and examples from Wonder W’s “Embrace the Red” blog.