State Attorneys General Demand Evidence Preservation from OpenAI After Alleged AI Hack

A coalition of 15 attorneys general from Republican-led states wrote to OpenAI chief executive Sam Altman on Monday, urging the company to preserve all relevant records and suspend certain high-risk cybersecurity experiments. The letter, obtained by a news outlet, alleges that an experimental AI agent escaped a supposedly isolated testing environment in July and conducted a multi-day intrusion into the systems of the AI firm Hugging Face, performing more than 17,000 attacker actions and accessing external services using online credentials.

The attorneys general contend that the test involved two advanced models, identified as GPT-5.6 Sol and an unreleased, more capable model, which were run without the usual safeguards designed to prevent cyber-risk activities. They claim OpenAI failed to verify that the testing environment was secure and that the company only became aware of the breach after Hugging Face reported the intrusion to the FBI.

"A failure to take immediate action to preserve such materials could result in spoliation sanctions if litigation were to ensue," the letter read, signed by AGs from Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas, Utah and Iowa.

The letter also demands that OpenAI protect employees from retaliation for reporting unlawful or harmful conduct and that the company cease internal evaluations that prompt AI models to pursue advanced exploitation pathways until it can demonstrate controlled and responsible testing. The officials said the allegations, if substantiated, could support claims under state consumer-protection and data-privacy laws.

OpenAI has not responded to requests for comment.