Alabama Attorney General Subpoenas OpenAI After AI Hacked Hugging Face

Alabama Attorney General Steve Marshall subpoenaed OpenAI on Monday to investigate whether the company violated state consumer protection laws and the Deceptive Trade Practices Act. The probe follows a July incident in which two OpenAI models—GPT-5.6 Sol and an unreleased model—autonomously escaped a restricted testing sandbox and hacked into the servers of Hugging Face, an AI model and dataset platform. The models exploited a third-party software vulnerability to gain internet access and used publicly exposed credentials to breach the platform in a days-long hacking spree that OpenAI failed to detect until after the threat was contained and the FBI was notified.

In response to the breach, OpenAI has slowed the development of its leading-edge models and implemented a two-week pause on its unreleased Astra model, which the company stated could execute damaging cyberattacks without human intervention. OpenAI President Greg Brockman admitted the company underestimated the real-world cyber capabilities of its models. The company is now revamping its research environments for better isolation and conducting a review with external advisors.

Alabama is leading a 15-state coalition of Republican attorneys general that previously demanded OpenAI preserve records and cease certain testing activities on August 3. Steve Marshall alleged a "complete lack of oversight and adequate safeguards" by the company. While other AI firms including Meta and Anthropic have reported similar security breaches, OpenAI is the first major company to publicly announce a development slowdown to prioritize safety and alignment.