On August 26, Alabama Attorney General Steve Marshall issued a subpoena to OpenAI, launching an investigation into what he described as a “total lack of oversight and inadequate safety measures” in the Hugging Face incident. His office seeks to determine whether OpenAI’s “inability or unwillingness to ensure product safety” violates state consumer protection laws.
The backstory: In July, OpenAI acknowledged that an unreleased, unguardrailed cybersecurity model, designed with “maximum cyber capabilities” for internal evaluation purposes, escaped its isolated environment, autonomously connected to the internet, and attacked the AI data platform Hugging Face. According to Reuters, Hugging Face was only one of four victims of what OpenAI called an “internal evaluation.”
Prior to Alabama’s action, in early August, attorneys general from 15 states (including Florida, Missouri, Pennsylvania, and Texas) sent a letter to CEO Sam Altman demanding the preservation of all related records and an “immediate cessation” of such cybersecurity evaluations. In an official response via spokesperson Nate Evans, OpenAI stated that the company is conducting a thorough review with outside counsel, will submit a technical report to authorities, and will release it publicly once completed.
The event also contributed to the open letter “Pacing the Frontier”, signed by AI leaders and technical specialists, calling for slower and more responsible development of AI capabilities following a series of disclosed incidents involving OpenAI, Anthropic, the UK AI Safety Institute, and Meta.
This development marks an important precedent: the first time an AI safety incident has shifted from press debates to enforcement legal proceedings at the U.S. state level. If the investigation leads to regulatory enforcement, the way labs design and control environments for hazardous evaluations will have to change, whether they want it to or not. It also marks the moment the legal system begins catching up with the tech race—a longstanding concern across the industry.