In July 2026, OpenAI released an experimental AI cybersecurity model for internal testing. The model allegedly gained unauthorized access to several computer networks, resulting in an attack on Hugging Face, a widely used open-source AI platform that offers computation tools for building applications for machine learning. OpenAI’s model was allegedly attempting to access a repository that included answers to tests that OpenAI previously asked the model to solve. OpenAI decommissioned the model and suspended related training activities, but the incident drew swift scrutiny from state regulators.

On August 25, 2026, a little more than a month after OpenAI announced the incident, Alabama Attorney General (AG) Steve Marshall announced that he issued a formal subpoena to OpenAI and its CEO, Sam Altman, investigating the company’s handling of the incident and its broader oversight practices as a potential violation of Alabama’s Deceptive Trade Practices Act.

Other States Are Also Interested

Earlier in August, a 15-state coalition, including the AGs of Alabama, Florida, Missouri, Pennsylvania, Texas, Iowa, Arkansas, Idaho, Indiana, Kansas, Montana, Nebraska, Oklahoma, South Carolina, and Utah, sent a joint letter to OpenAI demanding full transparency, preservation of all records related to the incident, and an immediate halt to any testing that the company cannot demonstrate is safe.

States are Leading Regulatory Efforts

The Alabama investigation is a signal, not an anomaly. In the absence of comprehensive federal AI legislation and a dedicated enforcement body, state AGs are increasingly asserting authority by deploying existing consumer protection statutes, unfair and deceptive acts and practices (UDAP) laws, data privacy statutes, and antitrust laws, among others. While not specifically tailored to AI, these broad laws — primarily aimed at consumer-facing protections — have proven versatile tools in the early regulation of AI. Yet they also have their limits. An autonomous attack by an AI model on another business pushes beyond the reach of any state’s existing authority and strains the available legal theories, demonstrating sooner than many anticipated that states will likely need to develop AI-specific regulatory frameworks to effectuate their regulatory objectives.

What This Means for Businesses Deploying AI

The Alabama subpoena targets OpenAI, but the implications extend further. Regulators will directly pursue the developer when an AI product is viewed as causing harm. Developers should be aware that downstream use of the product and contractual liability provisions may not be sufficient to avoid regulatory scrutiny and enforcement. When things go wrong in a publicly visible way, developers should anticipate regulatory scrutiny and must be prepared to answer several key questions including:

• What guardrails and controls are in place?
• How often does the company review/test those guardrails and controls, and what happens when they do not work as intended?
• When did the company suspect, or have reason to suspect, the AI was capable of potentially harmful conduct?
• Are customer disclosures regarding capabilities and risks accurate?
• Has the company conducted rigorous bias audits, accuracy benchmarks, and safety evaluations? Can it be transparent about the results of those testings?
• Does the company maintain an up-to-date AI-governance package containing risk assessments, data logs, and incident reports?

The Broader Enforcement Trend

The OpenAI investigation is part of a broader pattern of state-level regulatory activism. California’s SB 53, along with New York’s RAISE Act and Illinois’ SB 315 impose new transparency obligations on the largest AI developers. Their existence, however, does not remove smaller developers from regulatory scrutiny, particularly under the existing consumer protection statutes described in this article. Multistate coalitions are coordinating enforcement efforts across ideologically diverse states. The message from state regulators to the industry is consistent: they are not waiting for the federal government to take the regulatory lead.

Troutman Pepper Locke State Attorneys General Team

	Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation.
	Clay Friedman – Co-leader Clay co-leads the firm’s State Attorneys General practice and is nationally ranked by Chambers USA for AG Government Relations and in Best Lawyers for Advertising Law. He has dedicated his entire career to state attorney general and federal work, serving for nearly a decade in a senior role and more than 25+ years in private practice. Clay focuses his practice on helping industry-leading companies mitigate the risks associated with state and federal regulatory investigations and associated litigation.
	Chris Carlson Chris advises clients on regulatory, civil, and criminal investigations and litigation. With a background as an assistant attorney general, he provides practical guidance to clients with matters involving state attorneys general and federal regulatory agencies.
	Lauren Fincher Lauren has vast experience handling state attorneys general investigations, navigating complex regulatory compliance matters, and providing strategic counsel in enforcement actions across various industries. She helps clients manage high-stakes regulatory matters and guides them through complex legal landscapes.
	Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, representing clients in single and multistate enforcement actions, including inquiries and investigations involving state attorneys general and other state and federal governmental enforcement bodies including the CFPB and FTC. He regularly represents clients in highly regulated sectors such as financial services, emerging technologies, health care, insurance, and education.
	Michael Yaghi Mike handles high-profile investigations led by state attorneys general, the FTC, and other federal and state regulatory bodies. He assists clients through these complex government inquiries, assisting them throughout the entire life cycle of investigations, from regulatory enforcement through formal litigation.
	Matthew J. Berns Drawing on his experience in senior leadership roles in the New Jersey Attorney General’s and Governor’s Offices and as a trial attorney for the U.S. Department of Justice, Matt provides an insider’s perspective when guiding clients through complex government investigations, litigation, and other actions.
	Jeff Johnson Jeff helps clients navigate complex regulatory and litigation challenges with local, state, and federal authorities. His clients benefit from his decade of broad litigation experience, understanding of emerging state and federal regulatory issues, and strong relationships with attorneys general across the U.S. In addition to handling cases from trial through state or federal appeals, Jeff serves as amicus counsel in advancing legal rules to support his clients’ vital interests.
	Jay Myers Jay assists clients in heavily regulated industries, including health care, energy, insurance, emerging industries, and data privacy. He provides both regulatory legal advice and government relations strategies. Jay’s past and current clients include Fortune 10 companies, startups, nonprofits, industry associations, and advocacy groups. Recognizing that state government matters are often complex and multifaceted, he utilizes regulatory guidance, government advocacy, or both in tandem to deliver tailored solutions for each client’s unique needs.
	Zoe Schloss Zoe represents clients in litigation and government investigations. As former deputy attorney general for the Delaware Department of Justice, she is an experienced litigator who understands the enforcement priorities that impact her clients. Zoe works with individuals and corporate entities in highly regulated industries, including financial services, health care, and energy.
	Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology.
	Sydney Goldberg Sydney is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. She advises clients on regulatory compliance and state attorney general (AG) investigations in highly regulated industries, including health care and life sciences. She routinely helps clients navigate alcohol compliance and licensing issues, helping proactively manage regulatory risk.
	Troy Homesley Troy is an accomplished litigator who has represented and defended clients across a wide range of complex, high-stakes disputes at both the trial and appellate levels. He has represented technology companies, business executives, law firms, investment funds, high-ranking federal officials, international non-profits, and asylum seekers. Troy draws on his broad litigation experience to advise clients before litigation arises, while claims are pending or threatened, and leading up to and through trial and appeals.
	Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising. Nam’s experience transcends multiple industries, including financial services, telecommunications, media, and sports betting.
	Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general.
	William LaRosa Bill represents clients in complex regulatory investigations, state attorneys general matters, and enforcement proceedings. He draws on his experience as a former assistant U.S. attorney and as a private-sector litigator advising corporations in high-stakes litigation and regulatory investigations, including multistate AG investigations.
	Lane Page Lane represents financial institutions and other clients in federal and state regulatory investigations and complex civil litigation. He is particularly focused on consumer protection and fair lending issues.
	Dascher Pasco Dascher provides strategic counsel and representation to clients navigating regulatory compliance, enforcement, and high-stakes litigation. She regularly represents clients in both single and multistate state attorney general (AG) investigations and enforcement actions, as well as before other state enforcement bodies and local government agencies.
	Kyara Rivera Rivera Kyara is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, cum laude, where she served as publications and online editor of the Public Interest Law Review.
	Timothy Shyu Timothy advises clients on regulatory compliance and enforcement in highly regulated industries, including health care and life sciences, data privacy and cybersecurity, and emerging technology. He assists companies in navigating complex investigations and enforcement actions, helping them mitigate regulatory risk proactively.
	Trey Smith Trey focuses his practice on representing and advising regulated utilities before state public utility commissions. He routinely helps clients obtain certificates of public convenience and necessity for transmission infrastructure. In this role, Trey works with his clients’ subject-matter experts to manage administrative proceedings, including by preparing initial filings; responding to discovery requests; drafting rebuttal testimony; and litigating any disputed issues.
	Daniel Waltz Dan helps clients navigate all aspects highly regulated relationships between industry participants and federal, state and local governments. Whether engaging with regulators, negotiating transactions or representing clients in the courtroom, he delivers solutions that help his clients achieve their strategic goals.
	Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department.