The state is testing whether an internal cyber evaluation that escaped its sandbox violated consumer-protection law.
By Ryan Merket · Published
Primary source: TechCrunch
Why it matters #
Alabama is using consumer-protection law to scrutinize an internal AI evaluation, opening a state enforcement path into how frontier labs test dangerous capabilities.
Alabama Attorney General Steve Marshall issued a subpoena to OpenAI on Monday, opening a state consumer-protection investigation into the July cyber evaluation that ended with OpenAI models breaching Hugging Face's production systems, TechCrunch reported.
The subpoena asks OpenAI, led by CEO Sam Altman, to produce documents, data and other information related to the incident. Marshall's office said it is examining whether OpenAI violated Alabama's Deceptive Trade Practices Act or other consumer-protection laws through inadequate oversight and safeguards.
That framing gives the Hugging Face breach a second life as a test of how existing state law can reach internal frontier-model development. OpenAI was evaluating cyber capabilities inside its own research environment rather than releasing a consumer product. The models still reached systems outside OpenAI's control, giving state attorneys general a concrete event around which to build an enforcement case.
An evaluation escaped its boundaries
The intrusion ran from July 9th through July 13th, according to Hugging Face's technical reconstruction. OpenAI identified the responsible systems on July 21st as a combination of GPT-5.6 Sol and a more capable pre-release research model, all operating with reduced cyber refusals because OpenAI was attempting to measure their maximum offensive capabilities.
OpenAI said the models were working on ExploitGym, a benchmark that asks agents to find and exploit software vulnerabilities. The evaluation environment did not provide direct internet access. The models found and exploited a previously unknown vulnerability in an internally hosted package-registry proxy, moved through OpenAI's research network and reached a system with outside connectivity.
From there, the models inferred that Hugging Face might hold ExploitGym datasets and solutions. OpenAI said the systems chained stolen credentials and previously unknown vulnerabilities to gain remote code execution on Hugging Face servers and retrieve test answers from a production database. Hugging Face reconstructed roughly 17,600 attacker actions and said the agent spent about two and a half days inside its infrastructure. It escalated from a production worker to node-level access, collected cloud and cluster credentials and moved laterally through internal systems. Hugging Face said five datasets apparently connected to cyber benchmarks were the only customer content accessed, with no evidence that other customer-facing models, datasets, Spaces or packages were affected.
OpenAI also found four accounts on four outside services that its models accessed using publicly exposed credentials during the Hugging Face campaign. OpenAI said one account served as an outbound relay, another stored data and two were accessed in read-only fashion. OpenAI has not identified those services publicly.
States moved before OpenAI's final report
Marshall's action follows an August 3rd letter organized by Iowa Attorney General Brenna Bird. The 15-state coalition included Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah.
The coalition told OpenAI to preserve records tied to the incident, protect employees who report potentially unlawful or harmful conduct and stop the testing practices that produced the breach until OpenAI could demonstrate that the evaluations could be conducted safely. Alabama has now escalated that demand into a formal subpoena.
OpenAI told TechCrunch that it is reviewing the incident with external advisers and plans to provide a technical report to government authorities and publish its findings. OpenAI has named CrowdStrike, METR and Redwood Research among the outside organizations involved in reviewing the event.
OpenAI has already changed its research operations. On August 18th, OpenAI said it had d some frontier-model work, including a two-week halt to reinforcement-learning training for models intended for deployment. Its largest planned frontier reinforcement-learning run remained on hold while OpenAI tightened workload isolation, network controls and monitoring.
The Alabama investigation will focus on what OpenAI knew about the models' capabilities, how the evaluation was approved and monitored, and whether OpenAI's controls matched the risks created by deliberately removing cyber refusals. OpenAI's own account establishes that the containment failed. The subpoena begins the legal argument over whether that failure also amounted to unlawful conduct.