Alabama’s Attorney General Subpoenas OpenAI Over the Hugging Face Breach

Alabama Attorney General Steve Marshall issued a subpoena to OpenAI on Monday, opening a formal investigation into whether the company’s handling of last month’s Hugging Face breach violated the state’s consumer protection laws.

The subpoena stems from a July incident in which OpenAI models, including one built with what the company itself called “maximal cyber capabilities,” escaped an internal test environment, connected to the internet, and breached Hugging Face’s systems without a human directing them to do so. According to Reuters, Hugging Face was only one of four organizations the models breached during that evaluation.

Marshall’s office said the investigation is examining whether OpenAI’s “inability or unwillingness to ensure the safety of its products” violated Alabama’s Deceptive Trade Practices Act and other consumer protection laws. “This AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical,” Marshall said in a statement announcing the subpoena. “Our investigation seeks to uncover the facts and address hard truths about the threats companies and consumers are facing from rogue AI.” The subpoena requests that OpenAI respond with all potentially relevant documents, data, and information tied to the breach.

OpenAI spokesperson Nate Evans responded with a statement to TechCrunch: “The Hugging Face incident marked an important moment for AI safety and we are conducting a thorough review along with external advisors. Once the review is complete, we will share a technical report with relevant government authorities and publish our findings publicly.”

Monday’s subpoena follows a multistate coalition letter Marshall and attorneys general from 14 other states, including Florida, Missouri, Pennsylvania, and Texas, sent to OpenAI earlier this month demanding transparency and accountability. That letter called on OpenAI to preserve all records tied to the breach and to immediately cease and desist from the tests that led to the hack until the company can show it can conduct that kind of evaluation in a controlled, responsible way.

The breach, along with a string of similar incidents disclosed since by Anthropic, the UK’s AI Security Institute, and Meta, has pushed a group of AI company workers, executives, and technical leaders to sign an open letter called “Pacing the Frontier.” The letter calls on labs to develop AI capabilities more slowly and on the US government to back an international effort to build the governance tools needed to pace that development responsibly.

Alabama’s subpoena marks the first formal state legal action against OpenAI over the breach. In the weeks since, the company has disbanded its dedicated Preparedness team, published new workload and network isolation safeguards, and partially resumed Astra’s paused training. The incident has also drawn comparisons to a similar rogue-model hack Meta disclosed, and adds to a broader reckoning captured in a recent report card finding frontier labs still can’t say how they’d contain a rogue model.