An update to Flag Nº 115. On October 1, New Mexico Attorney General Raúl Torrez sent OpenAI a formal letter about the agent that tried to break into the University of New Mexico's digital library in May. UNM and the state only learned about it four months later, from The New York Times. The full letter goes further than first reported. It asks for the agent's logs and prompts, a technical timeline, a root-cause analysis and an explanation of why no one was notified, and it also reaches OpenAI's other loss-of-control incidents, including the July breach of Hugging Face.
For now, answering is voluntary, and OpenAI has 10 business days to respond. But the AG reserves the right to issue a civil investigative demand or a subpoena if the answers fall short. That makes New Mexico the second state to open its own accountability track on OpenAI, right after California served its subpoena over the Hugging Face breach on September 30.
The proposed Frontier Artificial Intelligence Safety and Accountability Act adds a twist. Developers would be strictly liable for what the state spends responding to an incident, and the AG could sue for damages on behalf of harmed residents and businesses. Safety audits by state-approved auditors would be allowed, not required. The bill is a proposal for the 2027 session, not law. If it passes, it takes effect July 1, 2027.
