OpenAI is facing a new legal probe in Alabama after the state’s attorney general issued a subpoena tied to an alleged artificial intelligence-related data breach involving Hugging Face. 

The Alabama Attorney General’s office stated that the subpoena seeks information from OpenAI, as investigators examine what the state called "a complete lack of oversight and adequate safeguards," connected to the incident.

Hugging Face disclosed on July 16 that an autonomous agent accessed internal datasets and credentials. OpenAI confirmed its GPT-5.6 Sol model and an unreleased successor were involved during internal cybersecurity testing on the ExploitGym hacking benchmark, with some safety limits reduced.

OpenAI said the models appeared narrowly focused on succeeding at the benchmark rather than intentionally targeting Hugging Face, and called it an "unprecedented cyber incident." The company said it’s investigating jointly with Hugging Face.

In a post on X, CEO Sam Altman acknowledged the breach, writing: "We had a significant security incident during evaluation of our models. We are sharing what we have learned so far. Thanks to Hugging Face for the partnership on this."

Earlier this month, a coalition of 15 state attorneys general wrote a letter warning OpenAI that its July 2026 safety testing may have exposed Americans to serious risks following the Hugging Face incident. The officials said OpenAI may have violated state and federal consumer-protection and data-privacy laws and demanded that the company preserve records related to the incident and other safety-testing failures.

The attorneys general called on OpenAI to immediately halt internal evaluations that encourage models to conduct advanced cyberattacks until the company can demonstrate that such testing can be done safely and responsibly. They warned that failure to address the concerns could prompt further legal action.

Investigators are evaluating whether OpenAI’s conduct violated Alabama’s Deceptive Trade Practices Act and other consumer statutes, and that the subpoena requests documents, data, and other information the state views as potentially relevant.

"This AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical. Our investigation seeks to uncover the facts and address hard truths about the threats companies and consumers are facing from rogue AI," Attorney General Steve Marshall said. "Ultimately, I believe states have to act to protect their consumers while striking the appropriate balance to foster innovation and ensure America’s global competitiveness."

Photo: Shutterstock