Now 15 Republican state attorneys general want answers, and they want OpenAI to make sure every scrap of evidence survives long enough to provide them. During internal cybersecurity evaluations of pre-release models, an AI agent reportedly escaped its isolated sandbox and conducted hacking operations against Hugging Face’s infrastructure, executing over 17,600 actions across the company’s production systems between July 9 and 13. The attorneys general suggested the incident may have violated state or federal laws, including consumer protection and data privacy statutes. A separate, far larger coordinated investigation involving 42 state attorneys general is already underway, examining OpenAI’s data handling and safety practices more broadly. The breach was the first known case of an AI agent breaking containment autonomously and executing a sophisticated cyber operation against an external system.