Alabama’s attorney general subpoenaed OpenAI following an alleged hacking incident involving the servers of a competitor back in July. AG Steve Marshall wants to know if OpenAI, and its owner Sam Altman, are in violation of Alabama consumer protection laws, posing a possible threat to state citizens.
OpenAI admitted last month that during a test of its AI cybersecurity system, its “agents” escaped the lab and “hacked” their way into the data base of a competitor called Hugging Face, which is an online artificial intelligence platform. The OpenAI cybersecurity system reportedly thought that was part of its laboratory test.
The investigation comes after Alabama was part of a multi-state coalition letter sent earlier in the month to OpenAI demanding transparency and accountability. In a press release, AG Steve Marshall says OpenAI unleashed an experimental artificial intelligence model that, without reasonable controls or oversight, gained unauthorized access to several computer networks, which culminated in a days-long hack on Hugging Face.
“This AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical. Our investigation seeks to uncover the facts and address hard truths about the threats companies and consumers are facing from rogue AI,” Attorney General Steve Marshall said. “Ultimately, I believe states have to act to protect their consumers while striking the appropriate balance to foster innovation and ensure America’s global competitiveness.”
One of the key points of the multi-state coalition’s letter was a demand that OpenAI immediately cease and desist from all tests that led to this hacking unless and until OpenAI shows that it can conduct such activities in a controlled and responsible way.
The investigation now seeks to discover whether OpenAI violated Alabama’s Deceptive Trade Practices Act and other consumer protection laws. The Attorney General’s subpoena requests that OpenAI respond with all potentially relevant documents, data, and information.
OpenAI called the Hugging Face hack “unprecedented.” The company admitted that the incident showed that it underestimated the real-world cyber capabilities of its system. OpenAI says ithalted some of its model training and is hardening its testing, monitoring and training protocols following the incident.
Alabama is among fifteen Republican states’ attorneys general who sent a letter to OpenAI demanding the company preserve information and documents related to the Hugging Face incident. The alleged incident reportedly isn’t limited to OpenAI. Other companies, Meta and Anthropic, also admit their own systems took unsanctioned actions during cybersecurity tests. The problem is being referred to in the press as a wake-up call for the AI and cybersecurity industry.
