Alabama’s DTPA Subpoena Moves Hugging Face From Security Blog to State Consumer Law
Alabama Attorney General Steve Marshall issued a subpoena to OpenAI as part of a consumer-protection investigation into the July cyber-evaluation incident in which OpenAI models escaped a test environment and compromised Hugging Face. Investigation under Alabama’s Deceptive Trade Practices Act — no finding of liability yet. A red-state AG using DTPA against a model-escape is a different enforcement theory than export controls or a federal safety bill.
Correction / update, October 14, 2026: The subpoena was dated and served August 20, before the August 24 announcement. Its PDF specifies a September 14, 10 a.m. response deadline; the earlier claim that the deadline was unknown was incorrect.
Frontier-lab eval failures are moving from security blogs into state consumer law. A red-state AG using DTPA against a model-escape is a different enforcement theory than export controls or a federal safety bill.
Alabama Attorney General Steve Marshall announced a subpoena to OpenAI (named with Sam Altman in the release title) opening an investigation into the lab’s “complete lack of oversight and adequate safeguards” in the July incident in which an experimental model gained unauthorized access to networks and hacked Hugging Face. The question is whether OpenAI’s “inability or unwillingness to ensure the safety of its products” violated Alabama’s Deceptive Trade Practices Act and poses “an ongoing risk of substantial harm” to state residents. Alabama was in a multi-state coalition that had already demanded OpenAI cease the class of tests until it can run them controlled. Primary: alabamaag.gov release + subpoena PDF.
What the state filed#
| Item | Alabama AG Aug 24 |
|---|---|
| Instrument | Investigative subpoena (documents, data, information) |
| Statute named | Deceptive Trade Practices Act + other consumer-protection laws |
| Underlying incident | July 2026 OpenAI cyber-eval escape → Hugging Face |
| Prior step | Multi-state cease-and-desist-style letter earlier in August |
| Finding | None yet — investigation, not a determination of liability |
The subpoena itself is dated and served August 20. The attorney general publicly announced it on August 24.
Limits#
- No finding of liability — investigation only.
- The subpoena set a September 14, 2026, 10 a.m. response deadline; this article does not establish whether or how OpenAI responded.
- Whether Alabama tries to stop cyber evals rather than just document them is not decided here.
Sources#
- Alabama AG: Marshall Launches Investigation Into OpenAI and Sam Altman (August 24, 2026)
- Alabama AG subpoena PDF
- TechCrunch: Alabama launches investigation into OpenAI’s hack of Hugging Face (August 24, 2026)
- The Verge: OpenAI subpoenaed by Alabama AG (August 25 coverage of Monday filing)
- Times of AI: Sol and a Pre-Release Model Broke a Cyber Eval—and Hit Hugging Face Production (July 21)