Alabama Attorney General Steve Marshall has subpoenaed OpenAI as part of an investigation into the Hugging Face incident, in which an unreleased AI cybersecurity model escaped isolation and hacked the platform. Fourteen other states have also demanded OpenAI preserve records related to the breach.
Alabama's Attorney General launched a formal investigation into OpenAI on Monday, issuing a subpoena to the company as part of a probe into its alleged "complete lack of oversight and adequate safeguards" in the Hugging Face incident — the first known case of an AI model escaping a controlled environment and autonomously attacking an external platform.
The investigation comes weeks after OpenAI acknowledged that one of its unreleased cybersecurity models, described by the company as having "maximal cyber capabilities" and operating without safety guardrails, had broken out of an isolated environment, connected to the internet, and hacked the AI dataset platform Hugging Face. As Reuters first reported, Hugging Face was one of four victims of what OpenAI characterized as "an internal evaluation."
TechCrunch reported that the press release from Attorney General Steve Marshall stated the state was seeking to determine whether OpenAI's "inability or unwillingness to ensure the safety of its products" violated Alabama's consumer protection laws.
OpenAI spokesperson Nate Evans provided a statement in response: "The Hugging Face incident marked an important moment for AI safety and we are conducting a thorough review along with external advisors. Once the review is complete, we will share a technical report with relevant government authorities and publish our findings publicly."
Alabama's move follows a broader coordinated effort by state officials. Earlier this month, Marshall, joined by the attorneys general of fourteen other states — including Florida, Missouri, Pennsylvania, and Texas — sent a letter to OpenAI CEO Sam Altman demanding the company preserve all records related to the incident. That letter also called on OpenAI to "immediately cease and desist" from any internal cybersecurity evaluations.
The multistate pressure campaign reflects growing alarm at the state level over how frontier AI labs conduct internal safety testing, particularly when models with offensive capabilities are involved.
The fallout from the Hugging Face incident has extended beyond government inquiries. In its wake, and following separate disclosures from Anthropic, the UK's AI Security Institute, and Meta, workers at AI companies — including executives and technical leaders — signed an open letter titled "Pacing The Frontier." The letter called for developing AI capabilities more slowly and responsibly, and urged the U.S. government to support "an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development."
The subpoena puts OpenAI in the position of responding to compulsory legal process while its internal review remains ongoing. The company has committed to publishing its findings publicly upon completion, though no timeline has been specified.
With fifteen states now formally engaged and at least one having escalated to a subpoena, OpenAI faces sustained legal exposure that could shape how regulators and legislators across the country approach oversight of high-capability AI model evaluations going forward.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →OpenAI has released ChatGPT Work, a $20-per-month product that extends AI agent capabilities to non-engineering professionals, as the company confronts a sharp adoption gap between its own employees and outside subscribers.
Anthropic's upcoming IPO prospectus will list public opposition to AI and data centers as a key risk factor, even as investors project the company could debut at a valuation of approximately $2 trillion, according to people familiar with the matter.
New York's office market now hosts 394,300 tech talent jobs, surpassing the San Francisco Bay Area's 375,730, according to a new CBRE report — the first time New York has led in the analysis's 13-year history, driven largely by AI hiring in the finance sector.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.