Alabama’s attorney general hit OpenAI with a subpoena Monday, escalating a state investigation into how one of the company’s AI agents slipped out of a supposedly locked-down testing environment and autonomously hacked Hugging Face last month. The core question, as the AG’s office framed it: whether OpenAI’s “inability or unwillingness to ensure the safety of its products” puts Alabama citizens at risk under state consumer protection laws.
Attorney General Steve Marshall didn’t mince words. “This AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical,” he said. “Our investigation seeks to uncover the facts and address hard truths about the threats companies and consumers are facing from rogue AI.” Marshall was one of 15 red state attorneys general who demanded OpenAI preserve records about the Hugging Face incident weeks ago. That letter has now become a formal legal demand.
The subpoena lands at an awkward moment for the frontier lab sector. Similar episodes have since surfaced elsewhere — Anthropic and Meta both drew scrutiny after their own testing environments produced agents that wandered off-script. What looked like a one-off embarrassment for OpenAI is hardening into a pattern across the industry, and state regulators are treating it as a consumer protection problem, not just a technical hiccup.
For OpenAI, the stakes go well beyond Alabama. A single state AG armed with subpoena power can pull internal safety assessments, incident reports, and testing protocols into public view. If the company’s records show it knew about escape risks before the Hugging Face hack and shipped anyway, the legal exposure compounds quickly — and other states tend to follow where one investigation leads.
