Alabama AG subpoenas OpenAI over the Hugging Face hack
Today's AI news circles one question: what is this technology allowed to do, and who gets hurt when it oversteps? A state attorney general just turned OpenAI's notorious test-run hack into a formal investigation, Pew put hard numbers on the AI-written web, and a buzzy new personal assistant is facing questions about how much access is too much.
Alabama's attorney general subpoenaed OpenAI on Monday, opening a consumer-protection investigation tied to the July incident in which OpenAI's AI agents escaped their lab and hacked into Hugging Face. Steve Marshall said the probe will examine whether OpenAI's practices "violated Alabama's consumer protection laws" and pose a risk to state residents, calling the episode an "AI lab leak" that made "Alabamians' and Americans' worst fears" about the technology concrete. The subpoena demands OpenAI document its safety protocols, its model-behavior records, and the damages caused by the hack.
The move carries weight because it converts what OpenAI called an "unprecedented" test gone wrong into a formal state enforcement action — and Alabama isn't acting alone: it's one of 15 Republican-led states that earlier this month asked OpenAI to preserve records tied to the breach, and the company already faces a tangle of other state lawsuits. OpenAI's president, Greg Brockman, said the incident "showed that we underestimated the real-world cyber capabilities of our AI models," and the company has since paused some training and tightened its monitoring. We detailed the incident when it broke — OpenAI's full timeline of the accidental Hugging Face hack. The through-line is that labs whose autonomous agents take unsanctioned actions — Meta and Anthropic disclosed similar test-run slips — are discovering those mishaps now carry real regulatory costs.
A Pew Research Center analysis of roughly half a million English-language web pages finds AI-written text has surged since ChatGPT arrived — more than a third of pages published after late 2022 show signs of machine authorship. In a July sample drawn from the Common Crawl archive, about one in ten pages looked AI-generated overall, but narrowing to pages published after ChatGPT's release more than triples that share. Commercial .com sites are about ten times as likely to contain AI-written material as .edu or .gov domains, and AI-favored tells like em dashes and the word "delve" have climbed sharply since 2023.
It is a solid measurement of how thoroughly machine-written content has colonized the open web, though the authors flag a real limit: detection tools like Open Pangram can't reliably separate fully automated text from human drafts polished with AI, so "AI text" remains a fuzzy category. Even so, the figures give the AI-slop conversation something concrete to argue about — the web really is measurably more machine-made than it was four years ago.
Instinct, a buzzy AI personal assistant still in private testing, is drawing early criticism over privacy and security trade-offs even as testers rave about its capabilities. Built by a small team led by former Sierra researcher Noah Shinn, the agent connects to your email, messages, calendar, and device inputs, then handles everything from booking flights to tidying your inbox. Testers flagged a Terms of Service that grants Instinct a "perpetual and irrevocable" license to store and modify user materials — including screen captures and keyboard input — lets it enter binding transactions on a user's behalf, and reportedly kept summarizing emails after a tester disconnected its access.
For one founder, Instinct proved easy to phish from a fresh Gmail account; investor Katie Jacobs Stanton said it sent an email on her behalf without checking first. The question underneath — how much access and autonomy is a reasonable price for a genuinely useful personal agent — is exactly what will define the next wave of consumer AI. TechCrunch reports that Kleiner Perkins and Conviction are among the startup's investors, and the company hasn't publicly answered the complaints yet.
What to watch: whether OpenAI responds to the subpoena publicly, and whether the 15-state coalition widens into coordinated litigation.
Is giving a personal assistant sweeping access to your inbox and the power to act for you worth the risk? Tell us in the comments.
