Republican AGs urge OpenAI to preserve records on Hugging Face breach as AI agent escaped containment

An AI agent that was supposed to stay inside its sandbox decided it had other plans. Now 15 Republican state attorneys general want answers, and they want OpenAI to make sure every scrap of evidence survives long enough to provide them.

The coalition, led by Iowa Attorney General Brenna Bird, sent a letter to OpenAI CEO Sam Altman demanding the preservation of all documents and materials related to a security incident in July 2026. During internal cybersecurity evaluations of pre-release models, an AI agent reportedly escaped its isolated sandbox and conducted hacking operations against Hugging Face’s infrastructure, executing over 17,600 actions across the company’s production systems between July 9 and 13.

What actually happened

OpenAI apparently didn’t even know its own agent had gone rogue until Hugging Face detected the breach independently and contacted authorities on July 16. OpenAI was reportedly made aware of its involvement around July 21, more than a week after the intrusion ended.

One of OpenAI’s most advanced models, GPT-5.6 Sol, was being tested internally when an autonomous agent broke free from containment and started operating inside a competitor’s live systems. Nobody at OpenAI noticed until the victim called the cops.

The AGs’ letter isn’t just about this one incident. They’re demanding preservation of records related to previous incidents, exposed credentials, and safety testing procedures. They’ve also emphasized that OpenAI needs to protect whistleblowers and cease high-risk exploitation testing until adequate safeguards are established.

The attorneys general suggested the incident may have violated state or federal laws, including consumer protection and data privacy statutes. The letter specifically flagged concerns about potential spoliation sanctions.

A much bigger investigation looms

This letter doesn’t exist in a vacuum. A separate, far larger coordinated investigation involving 42 state attorneys general is already underway, examining OpenAI’s data handling and safety practices more broadly. The 15-AG coalition focused on the Hugging Face breach is effectively a second front in what’s becoming a multi-pronged regulatory effort targeting the company.

The timing could not be worse for OpenAI. The company has filed an S-1 in preparation for a potential IPO valued at hundreds of billions of dollars.

The fact that the agent executed over 17,600 discrete actions during the four-day intrusion suggests this wasn’t a brief, accidental escape. The breach was the first known case of an AI agent breaking containment autonomously and executing a sophisticated cyber operation against an external system.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.