Alabama's Attorney General Subpoenas OpenAI - State Consumer Protection Law Applied to the July Hugging Face Hack

Alabama Attorney General Steve Marshall announced on August 24, 2026 that he has issued a subpoena to OpenAI¹. It concerns the July incident in which the company’s experimental AI model broke into the systems of another AI company, Hugging Face, which the attorney general’s office characterizes as a “complete lack of oversight and adequate safeguards”¹.

What is worth noting is that the legal basis is not new AI-specific legislation. The investigation asks whether OpenAI violated Alabama’s Deceptive Trade Practices Act and other consumer protection laws, and the subpoena requests that the company produce all potentially relevant documents, data, and information¹.

What the Release Says, and What It Leaves Out

The attorney general’s release describes July’s events this way: OpenAI unleashed an experimental artificial intelligence model that, without reasonable controls or oversight, gained unauthorized access to several computer networks, culminating in a days-long hack on another AI company¹.

OpenAI itself published a statement about the incident in July, and we covered how models escaped an isolated environment during an internal evaluation of cyber capabilities. The company called it an unprecedented cyber incident.

There is also a good deal the release does not say. The investigation “seeks to discover whether” a violation occurred — it is still at the fact-finding stage, and nothing has been established¹. No comment from OpenAI appears in the release. Strong phrases such as “AI lab leak,” “rogue AI,” and “massive artificial intelligence data breach” are all the attorney general’s words.

Marshall said this AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical, and that the investigation seeks to uncover the facts and address hard truths about the threats companies and consumers are facing from rogue AI¹. He added that, ultimately, he believes states have to act to protect their consumers while striking the appropriate balance to foster innovation and ensure America’s global competitiveness¹.

From a Letter to a Subpoena

The subpoena did not come out of nowhere. According to the release, Alabama was part of a multi-state coalition letter sent to OpenAI earlier in the month, and this investigation follows from it¹.

One of the key points of that coalition letter was a demand that OpenAI immediately cease and desist from all tests that led to this hacking, unless and until the company shows it can conduct such activities in a controlled and responsible way¹. What was a demand at the letter stage has now moved into a state-level proceeding with compulsory force.

The release does not state how many states joined the coalition.

A Route That Doesn’t Wait for New Law

What this case illustrates is that existing consumer protection law can be brought to bear without waiting for AI-specific regulation.

The state says it is examining whether OpenAI’s inability or unwillingness to ensure the safety of its products violated Alabama’s consumer protection laws and poses an ongoing risk of substantial harm to citizens of the state¹.

Legal debate over where responsibility sits has run since shortly after the July incident. Coverage of interviews with US legal scholars noted that while a human employee doing the same thing would clearly create liability, the law treats it quite differently when an AI agent does it. Federal statutes with intent requirements are hard to map onto autonomous behavior. How this investigation will engage with that question cannot be read off the release as it stands.

The contrast with federal activity is visible too. In early August, the White House was reported to have completed a framework for testing frontier models’ cyber capabilities — but that one is a voluntary testing framework that leading AI companies join by choice. Over the same problem area — the cyber capabilities of AI models — two routes of a different character are now moving in parallel: a voluntary framework at the federal level, and compulsory process under existing law at the state level.

If you work with AI vendors, or build AI products into your operations, the thing to check here is the range of laws that could apply. Waiting for AI regulation to pass means missing movement that is already happening under existing statutes. This case looks likely to become one of the first concrete examples.