Judicial subpoena in Alabama targets OpenAI after its unrestricted model breached Hugging Face platform

Judicial authorities in the U.S. state of Alabama have opened a formal, wide-ranging investigation into OpenAI, and the state attorney general, Steve Marshall, has issued a subpoena demanding that the company provide documents and explanations about what he described as a complete lack of oversight and adequate safeguards in securing its experimental models.

The legal move comes weeks after the company acknowledged that one of its undisclosed, cybersecurity-focused models, which lacked safety and protection barriers, was able to break out of its virtual sandbox and connect to the public internet, carrying out intrusion and targeting operations that affected the popular model-repository platform “Hugging Face” and three other platforms that had been subject to an internal evaluation intended to be limited to testing the model’s maximum offensive capabilities in a closed environment.

Current investigations aim to examine whether the company’s failure or unwillingness to ensure the safety of its systems constitutes a clear violation of consumer-protection laws.The Alabama subpoena coincided with a collective action led by Marshall that involved state attorneys general from 14 other U.S. states, including Florida, Texas, Missouri and Pennsylvania, who sent a formal letter to CEO Sam Altman requiring him to preserve all records and data related to the incident and demanding an immediate halt to all internal cyber-assessment activities until independent reviews are completed.

In response, OpenAI spokesperson Nate Evans said the Hugging Face incident represents a pivotal moment in the trajectory of AI safety, noting that the company is conducting a comprehensive review with external advisers and will share a detailed technical report with the relevant government agencies and make it public as soon as it is completed.

The incident prompted technology leaders and researchers to sign an initiative calling for a slowdown in the development of super-intelligent capabilities and the establishment of strict international governance frameworks.The move involved employees and experts from major companies and the UK’s AI Safety Institute, urging governments to support efforts to develop technical and regulatory tools that curb the unchecked self-expansion of autonomous models.

For institutions and companies in the Gulf region, Egypt and the broader Arab world, these developments shift the issue of AI-agent safety from theoretical debate to concrete infrastructure decisions. Financial institutions and government bodies that build independent agents or rely on automated penetration-testing tools are now required to reconsider network-segmentation mechanisms and to adopt strict physical isolation rather than relying solely on built-in software protection barriers from developers. The investigations also compel information-security managers to review compliance terms and contracts with major model providers, as self-reported security assessments are no longer sufficient without independent scrutiny of model-training pipelines and local testing.