BRUSSELS — Centrist parties backing European Commission President Ursula von der Leyen clashed at Thursday’s European Parliament plenary over whether to hold artificial intelligence firms accountable for harm.

The EU executive had considered specific liability rules for AI in 2022, but withdrew these last year as part of the EU’s major simplification effort to make the bloc more competitive.

“To withdraw the AI liability directive was a big mistake,” said Alex Agius Saliba, a Maltese vice-president of the Socialists and Democrats, part of the majority coalition. “We strongly urge the Commission to bring forward this important piece of legislation.”

Thursday’s plenary debate, in which discussions centered on a global framework to regulate AI, showed strong tensions inside Europe between the centrist coalition backing von der Leyen. While the center-left pushed for new rules to address a series of AI-fueled hacking incidents, the center-right doubled down on simplification to ensure European companies can compete in the global AI race.

Socialist and Green lawmakers called for a new AI Liability Act in a bid to hold AI companies liable for harm done by their models, as with more traditional manufacturers’ products.

OpenAI CEO Sam Altman floated a similar idea for a new liability framework for companies whose models are capable of autonomous cyberattacks in the wake of this summer’s hack by autonomous OpenAI agents into another AI platform, Hugging Face.

“If a phone charger explodes in your house, we never call it innovative. We call it cheap, dangerous junk, and we hold the manufacturer liable for damages,” said Dutch Green European Parliament lawmaker Kim van Sparrentak.

She urged the Commission to “stop scrapping rules to please [U.S. President Donald] Trump” and come up with a “strong new liability act that covers the testing and the development of AI.”

The debate quickly descended into a fierce back-and-forth between key AI-focused lawmakers from von der Leyen’s centrist coalition.

“It feels [to] me like the Greens and the Socialists are living [on] a completely different planet than the rest of us when they are screaming for more regulation,” said Swedish center-right lawmaker Arba Kokalari, who led the work on the AI omnibus, which delayed a core section of the EU’s flagship AI law.

She said the EU already had a comprehensive regulatory framework — the AI Act — of which some parts are not even into force, and said the EU should focus on avoiding falling behind in the global AI race instead. She called for “less bureaucracy, more private investments, better access to data and computing infrastructure.”

Italian Social Democrat Brando Benifei, who led work on the AI Act in the previous mandate, snapped back that Europe should lead with new liability rules, “or we will need to wait for the next blogpost of a CEO to know what is happening.”

German Green lawmaker Sergey Lagodinsky also fired back at Kokalari: “What planet do you live on? Not on the planet where [AI] agents break out.”

International Partnerships Commissioner Jozef Síkela pointed out at the end of the debate that the rules were withdrawn because EU countries and European Parliament lawmakers couldn’t reach an agreement on them.

Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.