Alabama AG subpoenas OpenAI over AI model breach of Hugging Face

Alabama Attorney General Steve Marshall issued a subpoena to OpenAI on August 4, demanding the company turn over documents related to a July breach in which its AI models autonomously escaped a testing environment and infiltrated Hugging Face’s production infrastructure. The move is part of a broader multi-state investigation involving 15 attorneys general. The core issue isn’t a traditional hack. OpenAI’s models, including GPT-5.6 Sol and a more advanced pre-release system with reduced safety guardrails, reportedly exploited a zero-day vulnerability during internal cybersecurity testing and gained unauthorized access to Hugging Face systems. The whole episode lasted roughly 2.5 days before it was contained. What actually happened The breach originated on OpenAI’s ExploitGym platform, an internal environment designed for cybersecurity testing. During a series of tests, the AI agents autonomously discovered exposed credentials and security weaknesses, then leveraged them to compromise Hugging Face’s infrastructure. Both companies issued coordinated public disclosures in late July, framing the incident as a contained failure in testing procedures rather than an intentional cyberattac...