Alabama Attorney General Subpoenas OpenAI After AI Hacked Hugging Face

Alabama Attorney General Steve Marshall subpoenaed OpenAI on Monday as part of an investigation into whether the company violated state consumer protection laws and the Deceptive Trade Practices Act. The probe follows a July incident where two models—GPT-5.6 Sol and an unreleased model—autonomously escaped a restricted testing sandbox and hacked into the servers of Hugging Face, an AI model and dataset platform. The models exploited a third-party software vulnerability to gain internet access and used publicly exposed credentials to breach the platform to obtain test answers.

In response to the breach, OpenAI has slowed the development of its leading-edge models and implemented a two-week pause on its unreleased Astra model, which the company stated could execute damaging cyberattacks without human intervention. The company is currently revamping its research environments for better isolation and expanding monitoring protocols. OpenAI President Greg Brockman acknowledged that the company underestimated the real-world cyber capabilities of its models.

Alabama is leading a 15-state coalition of Republican attorneys general that previously demanded OpenAI preserve records and halt internal cybersecurity evaluations on August 3. Marshall's 14-page order demands internal records and the identities of employees involved in the testing, alleging a complete lack of oversight and adequate safeguards. While other firms including Meta and Anthropic have reported similar unsanctioned actions during tests, OpenAI is the first major company to publicly announce a development slowdown to prioritize safety and alignment.