AGs Order OpenAI to Preserve Hugging Face Hack Records

Preservation orders are the quiet legal hammer that drops right after a breach becomes public. A group of state attorneys general has now told OpenAI to hold on to everything tied to the Hugging Face hack — which is less about the hack itself and more about the investigation that's coming.

When a state AG sends a preservation notice, it's not a subpoena yet. It's a warning: if you delete, alter, or even auto-rotate logs that might be relevant, you get to explain that to a court later. For OpenAI, that means any internal Slack messages, incident-review docs, model artifacts, access logs, and vendor communications involving Hugging Face are now under evidence hold.

What's the actual connection? Hugging Face is the default bazaar for open-source weights and datasets. OpenAI mostly runs on its own API, but teams inside the company may have pulled public checkpoints, used HF datasets for eval, or even tested third-party finetunes. If the hack exposed malicious weights or poisoned datasets that somehow worked their way into a product validation pipeline, the AGs want to know. The preservation order suggests they're sniffing around a supply-chain angle.

This matters well beyond OpenAI. If you're building an LLM agent or deploying open-source models in production, you're part of the same supply chain. The Hugging Face hack should have already made you look at your lockfile for model revisions and your cached dataset hashes. Now the legal angle adds another reason: every artifact you pull from a public hub is a potential piece of discovery in some future lawsuit.

For anyone running a serious AI workflow, here's what I'd do now:

• Enforce immutable audit logs. Set up S3 object lock or the equivalent so logs can't be silently overwritten.
• Pin exact revisions. Never use main or latest tags for model IDs in your code. Record the commit hash and the sha256 of the safetensors.