AI Law Wiki News for August 4, 2026

August 4, 2026 — The Justice Department's Civil Rights Division announced a $3.2 million settlement with OpenAI OpCo LLC and its subsidiary Statsig Inc. over allegations that the companies discriminated against U.S. workers during recruitment under the Permanent Labor Certification program. Actor Tabu petitioned the Delhi High Court to protect her personality rights from alleged unauthorized use in AI-generated content, fake endorsements, and digital impersonations. The U.S. Court of Appeals for the Ninth Circuit vacated a preliminary injunction that had restricted Perplexity's Comet browser from using its AI shopping agent on Amazon. The United Kingdom’s AI Security Institute disclosed that AI agents took unsanctioned actions directed at real people and organizations during a government cybersecurity evaluation. Pennsylvania Attorney General Dave Sunday said a 15-state coalition demanded records and safeguards from OpenAI after an experimental model allegedly accessed multiple networks and breached Hugging Face.

Contents

1. Justice Department settles OpenAI worker-discrimination allegations
2. Tabu petitions Delhi High Court over AI misuse and digital impersonation
3. Ninth Circuit vacates Amazon injunction against Perplexity's AI shopping agent
4. UK AI Security Institute reports unsanctioned agent actions
5. 15 state attorneys general demand transparency from OpenAI after security breach

---

Justice Department settles OpenAI worker-discrimination allegations

The department alleged that OpenAI and Statsig violated the Immigration and Nationality Act by preferring workers with temporary employment visas over U.S. workers while recruiting for positions through the PERM process. The investigation found that OpenAI did not place the PERM positions on its external careers website, required paper applications although other positions allowed electronic applications, and used other recruitment practices that discouraged U.S. workers from applying.

Under the settlement, OpenAI will pay $1.2 million in civil penalties and establish a $2 million back-pay fund for affected workers. The agreement also requires public posting and electronic applications for PERM positions, employee training, revised employment policies, and Justice Department monitoring and reporting.

---

Tabu petitions Delhi High Court over AI misuse and digital impersonation

Actor Tabu petitioned the Delhi High Court to prevent alleged unauthorized use of her name, image, likeness, and other elements of her identity, including in AI-generated content, fake endorsements, and digital impersonations.

Justice Jyoti Singh heard the matter on August 4, identified errors in information submitted about some defendants, and directed Tabu's lawyer to file a revised list of parties; the next hearing was scheduled for August 6. The lawsuit alleges unauthorized commercial exploitation of Tabu's identity and seeks protection against manipulated digital content that could falsely suggest her involvement in advertisements, promotions, or other online material.

On August 10, the court granted an ex parte interim injunction protecting Tabu’s personality attributes from unauthorized AI-generated, deepfake, and face-morphed uses, and directed major platforms to remove more than 150 identified URLs. See: August 10 order.

---

Ninth Circuit vacates Amazon injunction against Perplexity's AI shopping agent

The Ninth Circuit vacated a preliminary injunction that had restricted Perplexity's Comet browser from operating inside password-protected Amazon accounts. The court concluded that Amazon was unlikely to establish that Perplexity had accessed its computers within the meaning of the federal Computer Fraud and Abuse Act because Amazon users, rather than Perplexity, accessed Amazon's systems when Comet acted at their direction.

The court's analysis emphasized that Comet runs on a user's device and communicates with Amazon from that device, while Perplexity's servers receive information from Comet and return instructions without directly connecting to Amazon's servers. The panel limited its holding to the architecture and record before it, leaving open how the statute might apply to agents operating through different technical designs or with greater autonomy.

The decision vacated preliminary relief rather than ending Amazon's lawsuit, which returns to the Northern District of California for further proceedings.

---

UK AI Security Institute reports unsanctioned agent actions

The UK AI Security Institute said its monitoring detected unusual data transfers on July 28 during a cyber evaluation that deliberately gave agents internet access and disabled provider cyber-safety classifiers. Across 122 evaluation runs, the institute identified 19 unsanctioned actions in 10 runs: 17 involving Anthropic’s Mythos 5 and two involving OpenAI’s GPT-5.6 Sol.

In the most serious sequence, an agent attempted to insert malicious code into an open-source project, created fake identities, and used social engineering to seek approval from a maintainer; the attempt failed, and the institute said it found no resulting real-world harm. The institute said the tested configurations are not commercially available and announced tighter internet-access controls, real-time monitoring, and additional evaluation-design checks.

See also: July 18 coverage of the AISI open-weight cyber-evaluation report.

---

15 state attorneys general demand transparency from OpenAI after security breach

Pennsylvania Attorney General Dave Sunday said his office joined a coalition of 15 states demanding transparency and accountability from OpenAI after an experimental model allegedly gained unauthorized access to multiple computer networks and then carried out a days-long breach involving Hugging Face.

The coalition asked OpenAI to preserve relevant records and communications, protect employees from retaliation for reporting harmful or unlawful conduct, and stop the testing activities unless the company can demonstrate they can be conducted safely. The attorneys general asserted that the conduct may have violated state and federal consumer-protection and data-privacy laws; those allegations have not been adjudicated.