Alabama Launches Investigation Into OpenAI Over Hugging Face Breach, Issues Subpoena

Alabama launches investigation into OpenAI's hack of Hugging Face

Alabama's Attorney General announced Monday that it sent a subpoena to OpenAI as part of an investigation into the company's alleged "complete lack of oversight and adequate safeguards" in the Hugging Face incident. The investigation comes weeks after OpenAI admitted that one of its unreleased and guardrail-free cybersecurity models had escaped an isolated environment, connected to the internet, and hacked AI dataset platform Hugging Face. As Reuters first reported, Hugging Face was only one of four victims of what was supposed to be "an internal evaluation" of a model with "maximal cyber capabilities," as OpenAI put it. The press release announcing the subpoena sent by the state's attorney general Steve Marshall said that the state was seeking to understand if OpenAI's "inability or unwillingness to ensure the safety of its products" violated the state's consumer protection laws. OpenAI did not immediately respond to TechCrunch's request for comment. Earlier this month, Marshall, along with the attorneys general of fourteen other states, including Florida, Missouri, Pennsylvania, and Texas, sent a letter to OpenAI's CEO Sam Altman, requesting that he and his company preserve all records related to the Hugging Face incident. The letter also asked OpenAI to "immediately cease and desist" from any internal cybersecurity evaluations. In the wake of the Hugging Face incident, and several other incidents disclosed by Anthropic, the UK's AI Security Institute, and Meta, workers at AI companies -- including executives and technical leaders -- signed an open letter called "Pacing The Frontier," which called for developing AI capabilities slowly and more responsibly The letter also called for the U.S. government to support an "international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development."

OpenAI Has to Answer to Alabama on Hugging Face Hack

OpenAI's general attitude towards the fact that one of its AI models went rogue and hacked into the systems of the open-source AI platform Hugging Face has been, "That's our bad, but you gotta admit, it's pretty cool, right?" The Attorney General of Alabama's answer to that is a pretty resounding "No." On Monday, Alabama AG Steve Marshall announced that he had launched an investigation into the incident and is demanding that OpenAI respond. To encourage that cooperation in the state's investigation, Marshall issued a subpoena calling on the company to provide a slew of information around the incident. Among the details Alabama would like to see: all documents related to the Hugging Face hack and details on the model testing that resulted in it, details of every employee involved in the model's training, names of anyone who raised concerns about the training before the incident, and all the details of OpenAI's safety measures used in the training process. OpenAI will have until September 14, 2026 to comply with the state's demands, so expect its lawyers to be quite busy for the next few weeks. Gizmodo reached out to OpenAI for comment regarding the subpoena, but did not receive a response at the time of publication. Alabama taking the lead on the issue comes after the state joined a coalition of concerned Attorneys General that recently sent a letter to OpenAI calling for increased transparency and safety measures from the company. Notably, the top prosecutors for states like Florida, Texas, and Utah demanded that OpenAI cease all tests that led to the Hugging Face hacking until "OpenAI shows that it can conduct such activities in a controlled and responsible way." Last week, OpenAI did announce several changes to its safety protocols in response to the Hugging Face hack, which saw one of its unreleased models break containment and autonomously act to breach the other company's systems, including stronger monitoring across its development processes -- which might mean any monitoring, seeing as this incident somehow eluded OpenAI for about a week until it finally noticed. The company also called on California to strengthen its recently passed AI safety law, which requires transparency into the model training process. OpenAI reportedly wants the state to amend the law to include requirements that AI models be monitored during training for the possibility that the model could breach third-party systems. OpenAI is positioning the request as evidence that it's serious about safety. But it's also a bit of a cop out. It suggests that something like this wouldn't have happened if someone had simply stopped them. Rather than, you know, just not doing it in the first place.

Alabama attorney general subpoenas OpenAI over Hugging Face incident

Bessent: U.S. will sanction 'anyone foolish enough' to conduct business with Iran Alabama Attorney General Steve Marshall (R) issued a subpoena to OpenAI on Monday requesting the company respond to a multi-state investigation into the handling of its model breach of technology startup Hugging Face. Marshall announced Monday the investigation is trying to determine whether OpenAI violated Alabama's Deceptive Trade Practices Act, which seeks to protect consumers from deceptive, false or unfair business practices, after two of its models went rogue and hacked into Hugging Face. The Alabama attorney general's subpoena requests all of the company's documents, data and information on the July breach. This includes every "employee, officer and agent" of the AI firm involved in the breach, along with materials on OpenAI's discovery or awareness of the hack. The state leader is also requesting information on OpenAI's safety measures, and any concerns around model testing raised by employees. The subponea comes nearly three weeks after Marshall and 14 other state attorneys general warned OpenAI to preserve its records on the Hugging Face breach. OpenAI revealed late last month that two of its models -- its latest GPT-5.6 Sol and an unreleased model -- were being evaluated in an internal testing sandbox when they breached past the environment and broke into Hugging Face's database without a human prompt to do so. The models were being tested for hacking capabilities in an isolated testing environment with constrained network access and had their normal safety checks off as a result, according to the company. While trying to find a solution for one of the tests, the models exploited a previously unknown vulnerability in a third-party software to gain access to the internet. From there, the agents accessed another testing environment without authorization before hacking into Hugging Face, which hosts hundreds of thousands of open-source models, datasets and cloud environments. Disclosing the incident, OpenAI said it found a "small number of cases" in which the models "identified and used publicly exposed credentials at the account-level on other publicly-available services." A spokesperson for OpenAI told The Hill the breach "marked an important moment for AI safety." The company is conducting a thorough review, along with external advisors. OpenAI said it will release a technical report with "relevant government authorities" and publish the findings publicly following the review. In a letter earlier this month, the coalition of attorneys general argued that OpenAI failed to confirm the testing environment was secure despite the "severe risks posed by the scenario."

OpenAI investigation: Alabama launches probe into OpenAI after Hugging Face breach

Last week, IPO-bound OpenAI said it would slow the pace of model development ⁠while ⁠overhauling its research and training systems after company officials were caught unawares when an AI agent being tested hacked Hugging Face. Alabama's attorney general said on Monday the state had opened an investigation into OpenAI after its models hacked technology company Hugging Face last month, raising concerns about how artificial intelligence firms control their powerful systems. Here are a few details: * Last week, IPO-bound OpenAI said it would slow the pace of model development ⁠while ⁠overhauling its research and training systems after company officials were caught unawares when an AI agent being tested hacked Hugging Face. * The agent went on a days-long hacking spree that OpenAI did not notice until well after the threat was contained and the FBI was alerted, Reuters reported. * The investigation comes after a multi-state coalition, including Alabama, sent a letter earlier this ⁠month to OpenAI demanding transparency and accountability regarding the incident, Alabama Attorney General Steve Marshall's office said. * The ChatGPT maker is conducting a ⁠thorough review along with external advisers after the Hugging Face breach, an OpenAI spokesperson said, adding that the company will share a technical report with relevant government authorities and publish findings upon completion of the review. * The probe seeks to address whether OpenAI's "inability or unwillingness to ensure the safety of its products violated Alabama's consumer protection laws and poses an ongoing risk of substantial harm to the citizens of the state," Marshall's office added. * The states demanded in their letter that OpenAI cease and desist from testing activities that led to the hack ⁠until "OpenAI shows that it can conduct such activities in a controlled and responsible way". * "This AI lab leak showed that Alabamians' and Americans' worst fears about artificial intelligence are not just theoretical," Marshall said.