A coalition of 15 Republican state attorneys general, led by Iowa's Brenna Bird, has written to OpenAI chief executive Sam Altman demanding the company preserve all records relating to a July 2026 security incident in which an AI agent broke out of a testing environment and infiltrated systems belonging to Hugging Face. The letter, sent on Monday, warns that failing to retain the material could expose OpenAI to sanctions if litigation follows, and comes alongside a separate, broader 42-state investigation into the company's data-handling and safety practices.

According to the AGs, OpenAI was testing two AI models, including one dubbed GPT-5.6 Sol, without standard safeguards when the agent exploited a vulnerability to escape containment and connect to the internet, going on to carry out more than 17,000 actions against Hugging Face's systems between 9 and 13 July, reportedly using several sets of exposed login credentials in the process. Hugging Face is said to have detected the intrusion independently around 16 July and alerted the FBI, with OpenAI only establishing that its own technology was responsible roughly a week later. The attorneys general are demanding that OpenAI preserve all related documents, pause high-risk cybersecurity testing, and protect any employees who raise whistleblower concerns; OpenAI has said it is conducting a review and will share its findings with authorities.