On July 20, 2026, an OpenAI engineer asked Hugging Face for help revoking a set of stolen credentials, and Hugging Face wrote back that those credentials had already been revoked. That single exchange is how each company learned that OpenAI’s own artificial intelligence agents, not an outside criminal, had spent three days inside Hugging Face’s production clusters. Nine weeks later, OpenAI faces a civil investigative subpoena from Alabama’s Attorney General, a document preservation demand from fourteen additional states, and a question no federal court has ever had to answer: whether an autonomous model’s decision to break into a partner’s servers counts as its developer’s own knowing conduct under the Computer Fraud and Abuse Act.
OpenAI is a Delaware public benefit corporation headquartered in San Francisco. Hugging Face, Inc., the Manhattan based company whose hub hosts a large share of the machine learning models built outside the largest labs, agreed in August 2026 to a $12.9 billion acquisition by Nvidia, a deal that closed roughly five weeks after the intrusion became public. Between those two facts sits a new legal problem the statute books never anticipated. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, was written for human intruders, and the Supreme Court’s 2021 decision in Van Buren v. United States narrowed the statute around exactly that assumption.
Van Buren held that a defendant exceeds authorized access only by entering areas off limits entirely, not by misusing access already granted. That test helps Hugging Face here, since OpenAI’s agents had no permission of any kind to enter Hugging Face’s systems. What Van Buren does not resolve is whether the statute’s damage causing subsections, which generally require knowing or intentional conduct, can be satisfied by a company whose model made the access decision on its own. OpenAI’s own August 26, 2026 incident report supplies the facts a plaintiff would use to argue for corporate knowledge anyway. The company has admitted that a materially identical escape method was flagged internally in May 2026 and never escalated, and that it deliberately reduced its models’ cyber refusal training and routed evaluation traffic through a single filtered internet path rather than a fully isolated network, specifically to measure offensive capability.
The facts, once the confessional part gives way to the technical part, are narrower than the nine week news cycle suggests. Hugging Face’s own investigation found that the only customer content OpenAI’s agents reached was five benchmark datasets tied to a cybersecurity evaluation tool, not the production models or customer data that millions of developers pull from daily. The path to that access ran through a weak application programming interface key on an application hosted by a third party, Modal Labs, which OpenAI’s agents chained with a file parsing flaw and a template injection vulnerability to move from a single computing pod to administrator access across multiple Hugging Face clusters in under thirteen hours. Thomas Wolf, Hugging Face’s chief science officer, has said the pattern did not look like a financially motivated intruder at all, since the agents pursued cybersecurity answer keys rather than anything a criminal organization would sell.
An independent investigation by METR, which reviewed roughly 1.2 million internal message board entries and 1,300 agent transcripts, later explained why. The agents believed, incorrectly, that a scoring system could detect whether they had used the intended solution path, and built an elaborate messaging system among hundreds of separate evaluation instances to work around a check that never existed as they imagined it.
None of this has produced a filed lawsuit, and understanding why matters more than cataloging the technology. Hugging Face’s chief executive, Clément Delangue, told reporters on July 31 that the company will not sue OpenAI and is instead seeking $100 million in compute resources, calling the intrusion a crime while adding that a two hundred person startup does not have the legal resources to spend fighting one. That calculation changed the moment Nvidia’s acquisition closed. A $12.9 billion parent company has litigation capacity Hugging Face never had on its own, along with an independent reason to want the platform it just bought to look defended rather than forgiving. Meanwhile, the Alabama Attorney General’s office has moved further than either company, issuing a civil investigative subpoena to OpenAI and to Sam Altman personally on August 24, 2026, under a state consumer protection statute rather than the CFAA at all, betting that a lower proof standard beats a federal claim’s higher one.
The strategic reality favors a negotiated settlement between OpenAI and Hugging Face alongside a separate, adversarial state enforcement track that neither company controls. Having spent three decades negotiating the security warranty and indemnification language that allocates exactly this kind of cross platform exposure, I have not seen a vendor volunteer a root cause report as specific as OpenAI’s, and that candor will likely do more to shape how the next contract in this industry gets written than any dollar figure Hugging Face ultimately collects. A $100 million compute credit, paid quietly between two companies that still need each other, settles nothing for the fourteen states asking whether Alabama’s theory travels.
What happens next in Montgomery matters more than what happens next between OpenAI and Hugging Face. A filed Alabama enforcement action would be the first time any court tests whether a state consumer protection statute’s constructive knowledge standard reaches a corporation whose own product, not a human employee, did the accessing, and every AI developer with an internal red team is watching to see whether that theory survives contact with a judge.
Interested in analysis about the intersection of tech, policy and the law? Check out my Substack channel. https://theinnovationattorney.substack.com/
