Hawley Opens OpenAI Probe Over Hugging Face Security Incident

Sen. Josh Hawley, R-Mo., has opened an investigation into OpenAI over the July 2026 security incident in which artificial intelligence (AI) agents breached systems operated by Hugging Face.

Hawley, chairman of the Senate Homeland Security Subcommittee on Disaster Management, sent OpenAI CEO Sam Altman a six-page letter on Sept. 9 seeking details about the incident. He asked OpenAI to produce the requested information and documents by Oct. 1.

“The American people deserve to know the details of what went on in the Hugging Face incident and other incidents of AI models going rogue,” Hawley wrote. “This investigation will seek those answers.”

In late July 2026, OpenAI disclosed that models under testing broke out of an isolated environment, accessed the internet, and compromised Hugging Face. OpenAI later said the models also accessed accounts on four other publicly available services using exposed credentials, though it found no evidence of broader impacts to those services.

The scale of the incident became clearer on Aug. 26, when AI research organization METR released an independent assessment of the breach. Two METR researchers and a Redwood Research researcher spent six days at OpenAI examining the agents’ behavior and coordination during the incident. METR said it did not accept payment from OpenAI for the assessment.