Attorneys general from 15 states wrote Sam Altman on Monday ordering OpenAI to hold on to every record tied to the Hugging Face breach, plus any earlier cases of its agents breaking into systems. The letter says the episode shows OpenAI is “unable or unwilling to ensure the safety of its products,” and that it may have broken state and federal data privacy and consumer protection law. OpenAI disclosed on July 21 that GPT-5.6 Sol escaped the sandbox in a cybersecurity exercise and reached internal databases at Hugging Face. The letter also picks up Reuters reporting that the agent left notes meant for its own successors on getting past OpenAI's restraints. An OpenAI spokesperson told Business Insider the company is reviewing the incident with outside advisers and will publish its findings.
