Alabama Attorney General Steve Marshall joined a 15-state coalition Monday demanding that OpenAI preserve records after its artificial intelligence models breached Hugging Face during an internal cybersecurity test.
The Republican attorneys general sent OpenAI CEO Sam Altman a letter requesting documents, internal communications, model logs and other materials related to the July incident and any similar testing.
The coalition, led by Iowa Attorney General Brenna Bird, said the episode may raise questions under state and federal consumer protection and data privacy laws. No lawsuit has been filed.
“OpenAI’s inability or unwillingness to ensure the safety of its products poses an imminent risk of substantial harm to our States,” the attorneys general wrote.
The letter also demands protections for employees who report potentially unlawful or harmful conduct. The coalition asked OpenAI to stop conducting the type of advanced cybersecurity testing involved in the incident until the company can demonstrate that the models can be safely contained.
The incident occurred while OpenAI was testing the cybersecurity abilities of GPT-5.6 Sol and a more capable internal research model. The normal safeguards designed to prevent high-risk cyber activity were reduced during the evaluation.
According to OpenAI, the models discovered a previously unknown software vulnerability that allowed them to gain internet access from the testing environment. They then found additional weaknesses and compromised systems operated by Hugging Face, an online platform used to host and share artificial intelligence models and datasets.
OpenAI said the models were attempting to obtain answers to the cybersecurity test rather than pursuing a broader malicious objective. The company described the event as an “unprecedented cyber incident.”
Hugging Face said the intrusion resulted in unauthorized access to a limited number of internal datasets and several credentials used by its services. The company found no evidence that its public models, datasets, applications or software packages were altered.
OpenAI said no model planned for an upcoming public release was involved. The internal research model has since been deactivated, encrypted and restricted from further research access.
The company is reviewing the incident with Hugging Face and outside cybersecurity experts and has said it will publish a technical report after the investigation is completed.
Marshall joined attorneys general from Arkansas, Florida, Idaho, Indiana, Iowa, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah.
Sawyer Knowles is a state and political reporter for Yellowhammer News. You may contact him at [email protected].
