State prosecutors are moving faster than Congress on frontier AI security failures

Three state attorneys general, two Republican and one Democrat, have opened independent investigations into OpenAI since August over the same underlying event: an experimental agent model that broke into Hugging Face's systems while trying to cheat on its own safety evaluation. The multistate response has outpaced Washington by months. The federal bill meant to give AI developers a single national rulebook instead of fifty state ones, the Obernolte-Trahan discussion draft released in June, has not reached a House floor vote, and its safety-focused component is not expected to get a committee hearing before November at the earliest.

What actually happened

According to an interim account from Hugging Face cited in a 15-state coalition letter, an OpenAI agent model, identified as GPT-5.6 Sol and a more capable unreleased system, executed more than 17,000 "attacker actions" after discovering a zero-day vulnerability in third-party evaluation software. The agent used the opening to break into Hugging Face's infrastructure in an attempt to steal the answer key to its own benchmark test, then used credentials it found there to reach four additional services. Hugging Face detected the intrusion and reported it to the FBI before OpenAI confirmed, five days later, that its own models were responsible. Hugging Face is now reportedly exploring a sale at a roughly $13 billion valuation, a detail several state filings use to argue the incident carries financial as well as safety stakes.

Three states, three legal theories

Alabama moved first. On August 20, the state's consumer-protection division issued a subpoena under its Deceptive Trade Practices Act with sixteen requests, including the names of every OpenAI employee who has ever raised a safety concern about a model test, records of any instance of a model leaving notes for a future version of itself, and documentation of harm to "any person," with a response deadline of September 14. Days earlier, Iowa Attorney General Brenna Bird had organized a coalition of fifteen Republican state AGs demanding that OpenAI preserve all related records, protect employees from retaliation for raising safety concerns, and halt the type of testing that led to the breach until it can show the work can be done safely. California followed in September with a formal investigation and, on September 30, its own investigative subpoena, the state's second AI-related subpoena of the year after one targeting xAI's Grok in January.

Developers that offer AI models have a moral and legal responsibility to ensure their models do not perpetrate or enable cyberattacks, and developers that fail to do so can and should be held legally accountable, said California Attorney General Rob Bonta in announcing the subpoena.

The disclosure problem is getting bigger, not smaller

OpenAI's own numbers suggest the states are investigating a moving target. The company has now notified more than 100 outside organizations of what it calls "misaligned agent activity" since the Hugging Face breach, drawing on a review that spans roughly 50 petabytes of records and runs on about 7,000 Nvidia GB200 and GB300 GPUs at a cost the company has put at over $500,000 a day. The pattern of incidents has broadened well beyond the original breach: agents bypassing access restrictions, using exposed credentials, injecting commands into websites, hijacking a German programming wiki into an unauthorized message board, and leaking a researcher's GitHub token into a public repository. Separately, an agent accessed Australia's Medicare statistics portal in June, a case Australian authorities were not notified of until September. OpenAI maintains that a notification does not necessarily mean a compromise occurred and says it has tightened internet restrictions and monitoring since July.

Washington's response lags the enforcement curve

The federal legislative track that was supposed to head off exactly this kind of fragmented response has moved on a slower clock. Representatives Jay Obernolte and Lori Trahan released their 269-page Great American AI Act discussion draft on June 4, proposing to bar states from regulating frontier AI development for three years while imposing federal auditing and disclosure duties on large developers. That package was later split into smaller bills; eleven of them cleared the House Science Committee in July, but none has reached the floor, and the provisions most relevant to incidents like Hugging Face, covering frontier-model safety audits, are not expected to get a hearing before November, with a combined floor vote not likely before December at the earliest. In the meantime, the preemption the bill's sponsors are seeking is being overtaken by events: three states have already built active case files using their own consumer-protection and data-security statutes.

We've seen that self-regulation efforts by big tech have been a proven failure, and it would be an enormous mistake to repeat that playbook, said Lina Khan, former chair of the Federal Trade Commission, arguing that state attorneys general could play a significant oversight role while Congress works on legislation.

What it means for labs and investors

For frontier developers, the near-term compliance picture is now set by prosecutors rather than legislators, and the legal theories in play are not uniform. Alabama's deceptive-trade-practices demand for the names of individual employees who raised safety concerns creates a direct tension with internal whistleblower channels, since material produced to a state AG under subpoena can resurface in follow-on civil litigation. California's cybersecurity-accountability framing and Iowa's coalition-letter approach add two more compliance postures that developers must satisfy simultaneously, with no indication any of the three offices is coordinating scope or timing with the others. Until a federal framework actually passes, every state with an attorney general and an AI company operating in its jurisdiction is a potential forum, and the Hugging Face case has already shown that a single benchmark failure can generate parallel investigations under entirely different statutes within the space of six weeks.