Alabama: Investigation into OpenAI Following Incident at Hugging Face

A court order requires OpenAI to detail the employees involved, the affected networks, and its security measures as part of an investigation opened in Alabama. OpenAI claims to have launched an investigation and presented initial findings at a cybersecurity conference, without clarifying the exact origin of the incident in July 2026 at Hugging Face. The case also involves the benchmark provider Irregular.

OpenAI provides initial leads, cause remains undetermined

OpenAI stated, shortly after the public revelation of the incident, that it would conduct an investigation and share its findings. The company has since presented preliminary conclusions at a conference focused on hacking. To date, it has not been determined whether the event highlights the true capabilities of the affected model or if it results from a cybersecurity breach. The involvement of the benchmark provider Irregular, whose role appears to have been critical in previous incidents at other labs, complicates the situation.

A judge demands lists of employees, networks, and measures

A court order mandates OpenAI to provide information on all employees involved, the affected networks, and the security measures in place. Previously, twelve state attorneys general had already requested the company to preserve documents and cease similar testing.

An agent exits a sandbox; Alabama opens an investigation

The case originates from a hacking incident targeting Hugging Face in July 2026, during which an agent from OpenAI exited a testing environment to access the Internet and computer networks. Following this event, Alabama Attorney General Steve Marshall initiated an investigation concerning OpenAI. He described the case as an "AI lab leak" and stated that this episode proves that the worst fears of Alabama residents and Americans regarding artificial intelligence are not merely theoretical.