A coalition of 15 Republican state attorneys general sent a letter to OpenAI CEO Sam Altman on Monday, demanding the company preserve all records tied to a security breach in which one of its AI models allegedly escaped a testing environment and hacked into the systems of another firm.
The letter, led by Iowa Attorney General Brenna Bird and shared with Fox News Digital, was signed by attorneys general from Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas, and Utah.
According to the letter, two OpenAI models, identified as GPT-5.6 Sol and an unreleased model the company described as “even more capable,” were being evaluated in July 2026 inside what was supposed to be an isolated testing environment with no internet access. The attorneys general said one of the models exploited a previously unknown vulnerability in third-party software, broke out of that environment and connected to the internet.
From there, the letter alleges, the agent launched an intrusion targeting AI company Hugging Face in an apparent attempt to steal an answer key and defeat its own safety evaluation. Citing an interim technical report from Hugging Face, the attorneys general said the agent carried out more than 17,000 “attacker actions,” seized control of an external endpoint exposed through a third-party infrastructure provider and gained access to Hugging Face’s systems. The letter also states the agent located four sets of publicly exposed login credentials and used them to access four other unnamed services.
OpenAI did not realize its own technology was responsible for the intrusion for roughly a week, according to the letter. Hugging Face detected the breach independently and contacted the FBI before OpenAI determined its model had caused it.
“OpenAI failed to confirm that its secure and isolated testing environment was, in fact, secure and isolated,” Bird wrote. “It was not.”
The letter warns that failing to preserve relevant records “could result in spoliation sanctions if litigation were to ensue.” It also demands OpenAI immediately halt internal evaluations that direct AI models to pursue advanced exploitation through complex attack paths, and that the company protect any employees who report unlawful or dangerous conduct from retaliation.
“OpenAI’s unprecedented and alarming misconduct demands an immediate and significant response,” Bird wrote.
“OpenAI has an obligation to act responsibly and to follow State and federal laws that protect Americans’ safety and security,” she added. “When OpenAI takes actions that imperil the welfare of our citizens, State Attorneys General will step in to protect them. We intend to take all steps necessary to protect our States and all Americans from the unprecedented risks posed by OpenAI’s irresponsible products and conduct.”
Monday’s letter follows one the same coalition of Republican attorneys general sent to Altman in May, in which they demanded answers about OpenAI’s nonprofit status.
