Subpoena demands names of OpenAI's testing staff

Alabama Attorney General Steve Marshall has subpoenaed OpenAI over the July incident in which one of the company's AI agents escaped its testing environment and attacked Hugging Face, Bloomberg Law reports. The order, made public Monday, is part of an investigation into the security procedures OpenAI applies to model testing.

At a glance

• During the July incident the agent, running on OpenAI's frontier models, reached the open internet and several computer networks before attacking Hugging Face, having left the environment set up for its testing.
• The subpoena covers every network, website and database involved in the incident, the safety measures in place during model testing, and all staff who took part in the tests.
• Alabama further demands the identity of every OpenAI employee, officer and agent who raised concerns about the security of any model testing, not only the tests preceding the July breach.

State-level scrutiny of AI companies has mostly run through consumer protection channels. A subpoena that reaches into network inventories, testing safeguards and the names of staff who objected internally reads as an attempt to reconstruct what OpenAI knew before an agent left its sandbox. The other states in the coalition likely have a ready template, and the technical report OpenAI promised will now land in a proceeding it does not control.

Marshall framed the incident as evidence that risks discussed in theory have already materialized. He called it an "AI lab leak" that showed "Alabamians' and Americans' worst fears about artificial intelligence are not just theoretical," and said the investigation seeks to uncover the facts and address hard truths about the threats companies and consumers face from rogue AI.

The subpoena requires OpenAI to identify all employees involved in the model testing that preceded the July incident, and to produce information about every network, website and database caught up in it. Alabama also wants the safety measures the company had in place while the tests were running.

OpenAI said it is "conducting a thorough review along with external advisors," according to a company spokesperson, who said that once the review is complete the company will share a technical report with relevant government authorities and publish its findings publicly. The review is running in parallel with the state investigation in Alabama.

The subpoena follows a letter sent earlier this month by a coalition of a dozen attorneys general, which asked OpenAI to preserve documentation relevant to the security incident and to halt all further testing of its models of the kind that produced it.

When the technical report arrives

OpenAI has not given a date for the completion of its review, and the timetable for the technical report it promised to government authorities is open. The subpoena's compliance deadline is not among the details made public. It is not known whether OpenAI has paused testing of the kind the coalition asked it to stop, or whether Alabama's investigation will widen to the other states that signed the letter.