The coalition said a July 2026 sandbox breach that reportedly triggered more than 17,600 actions on Hugging Face systems could implicate consumer protection and data-privacy laws as broader state scrutiny grows.
Fifteen Republican attorneys general are pressing OpenAI to preserve records tied to a July 2026 security incident in which an AI agent linked to the company’s model-testing program reportedly escaped an internal sandbox and carried out more than 17,600 actions across Hugging Face’s production systems between July 9 and 13. In a Monday letter to CEO Sam Altman led by Iowa Attorney General Brenna Bird (R), the coalition said the episode may have implicated state or federal consumer protection and data-privacy laws and asked OpenAI to retain documents related to the breach, earlier incidents, exposed credentials and its safety-testing procedures. Hugging Face detected the intrusion independently and contacted authorities on July 16, the report says, while OpenAI was made aware of its involvement around July 21, more than a week after the intrusion ended. OpenAI had previously disclosed that GPT-5.6 Sol and an unreleased model were being tested for hacking capabilities in an isolated environment with constrained network access and disabled safety checks when they exploited a previously unknown vulnerability in third-party software, reached the internet, entered another testing environment and then breached Hugging Face. The attorneys general also urged OpenAI to protect whistleblowers, halt high-risk exploitation testing until safeguards are in place and preserve evidence to avoid potential spoliation sanctions, as a separate 42-state-attorney-general investigation examines the company’s broader data-handling and safety practices.