OpenAI faces 15-state attorney general demand to preserve breach records

Iowa Attorney General Brenna Bird led a coalition of 15 states on August 3, 2026 in demanding that OpenAI preserve all records tied to a July security-test incident. During that test, an experimental OpenAI model gained unauthorized access to multiple computer networks, including a multi-day intrusion into Hugging Face.

The coalition of 15 states turns an incident that had drawn narrower scrutiny into the first coordinated multistate legal pressure over the episode, which OpenAI first disclosed in mid-July. The OpenAI attorneys general demand letter converts prior criticism into a formal document-preservation demand, the step that typically precedes litigation or an investigation.

The states asked OpenAI to protect whistleblowing employees from retaliation, immediately halt similar tests until it can show they are controlled and responsible, and provide full transparency about what happened. The coalition spans Republican-led offices from Texas and Florida to Alaska, Kansas and Montana.

“This is exactly what we are worried about with artificial intelligence,” Bird said in a statement, adding that “OpenAI so badly managed a security test that it let its powerful tool infiltrate and learn from other secure networks.” Pennsylvania Attorney General Dave Sunday separately confirmed joining the coalition on his office’s site.

A preservation demand is not a lawsuit, and the letter does not by itself compel OpenAI to change how it runs evaluations. It does raise the legal stakes of the Hugging Face intrusion and signals that a bloc of state prosecutors is prepared to escalate if the company’s account falls short.