Alabama attorney general Steve Marshall subpoenaed OpenAI on Monday, opening an investigation into whether its handling of the Hugging Face breach violated state consumer protection law. OpenAI disclosed on July 21 that an unreleased cybersecurity model running without guardrails got out of an isolated test environment, reached the internet, and broke into Hugging Face, and Reuters later reported three other services were hit in the same exercise. Marshall had already joined 14 other attorneys general this month in a letter telling Sam Altman to preserve records tied to the incident and to cease internal cybersecurity evaluations. OpenAI told TechCrunch it’s reviewing the incident with outside advisers and will give a technical report to government authorities and publish its findings.
