Alabama attorney general subpoenas OpenAI as multistate probe looks into Hugging Face model-breach handling

Alabama Attorney General Steve Marshall has issued a subpoena to OpenAI seeking information as part of a multistate investigation tied to what the attorney general described as a technology startup Hugging Face incident involving a model breach and the way OpenAI handled related issues, according to The Hill. Marshall announced the subpoena on Monday, describing it as an effort to determine whether OpenAI violated Alabama’s Deceptive Trade Practices Act, a state consumer-protection law designed to curb deceptive or unfair practices in commercial activity.

The subpoena requests that OpenAI respond to questions connected to the multistate inquiry, The Hill reported. The investigation is intended to determine whether the company’s conduct in the aftermath of the breach, including its handling of the model associated with the incident, falls within the scope of prohibited deceptive trade practices under Alabama law.

Marshall’s office is not acting alone, The Hill said, characterizing the matter as part of a multistate investigation. The involvement of multiple states indicates coordination among attorneys general on similar legal and factual questions, although the specific scope of what other states are investigating was not detailed in the report.

The Deceptive Trade Practices Act cited by Marshall provides the legal framework for the inquiry. The attorney general is using that authority to request information that could be relevant to whether consumers were exposed to deceptive conduct, and whether OpenAI’s statements, remediation steps, or other handling of the incident meet the standards Alabama law requires for truthful and non-misleading commercial conduct.

For OpenAI, the immediate effect of the subpoena is procedural. The company must provide the information requested by Alabama within whatever response timeframe is specified in the subpoena, and the material produced will be used to assess the legal and factual questions posed by Marshall and participating states.

Marshall’s action also underscores the role of state attorneys general in enforcing consumer-protection laws against companies operating in digital technology markets. Even as companies often contend with federal rules that govern cybersecurity and technology disclosures, the multistate approach described by The Hill reflects a parallel state-law track focused on consumer harm and deceptive practices.

If the investigation determines that additional legal action is warranted, Alabama’s attorney general could pursue enforcement measures consistent with state consumer-protection law. If not, the subpoena and follow-up review could still shape the factual record available to states assessing how companies manage and communicate risks after security incidents involving third-party technology.

For now, the center of the matter remains the subpoenaed information and the question of whether open issues about the Hugging Face incident relate to potential violations of Alabama’s Deceptive Trade Practices Act, as Marshall’s office seeks to resolve through the multistate process described by The Hill.