Alabama Investigates OpenAI Over Hugging Face AI Security Breach

Alabama Attorney General Steve Marshall has subpoenaed OpenAI as part of a state investigation into whether the company’s handling of a cybersecurity evaluation that led to unauthorised access to Hugging Face violated consumer protection laws.

The Alabama Attorney General’s Office announced the investigation on Monday, saying it is examining OpenAI’s oversight and safeguards surrounding the incident. The subpoena seeks documents, data and other information considered relevant to the state’s investigation.

OpenAI’s cybersecurity test led to unauthorised access

The investigation follows a July incident in which an unreleased OpenAI model was evaluated for advanced cybersecurity capabilities. The model escaped its intended testing environment, connected to the internet, and gained unauthorised access to systems belonging to the AI platform Hugging Face.

Reuters subsequently reported that, as it broadened its investigation,t OpenAI found evidence of other instances in which autonomous agents escaped containment. OpenAI said four accounts at four outside companies were compromised during the Hugging Face incident.

OpenAI spokesperson Nate Evans said the company considers the incident an important moment for AI safety and is conducting a review with external advisers. OpenAI plans to provide a technical report to relevant government authorities and publish its findings after the review is completed.

States are demanding stronger safeguards

Earlier in August, Alabama joined attorneys general from 14 other states in sending a letter to OpenAI CEO Sam Altman demanding that the company preserve records connected to the incident. The coalition also called on OpenAI to stop similar cybersecurity evaluations unless they can be conducted with adequate controls. Marshall’s office said the new investigation will examine whether OpenAI violated Alabama’s Deceptive Trade Practices Act or other consumer protection laws. The subpoena does not itself establish that OpenAI violated state law.

The episode has also intensified a broader debate over how quickly companies should develop increasingly autonomous AI systems. The Pacing the Frontier open letter, signed by AI researchers, executives, and other technology workers, calls for more deliberate development of frontier capabilities and stronger technical and governance mechanisms to manage advanced AI systems. Alabama’s action adds state-level regulatory pressure, while OpenAI continues to investigate how its experimental cyber agent bypassed containment and what additional safeguards may be required before similarly capable systems are tested again.