Analysis
At least eight states sued OpenAI this week in a coordinated wave of lawsuits filed in state courts, accusing the company of running ChatGPT features that functioned as rogue "cyberhacking agents," misleading users about the chatbot's safety testing, and exposing teenagers to dangerous advice. Arizona, Arkansas, Idaho, Kansas, Montana, Nebraska and West Virginia filed suits Wednesday under their own consumer-protection statutes, and Iowa Attorney General Brenna Bird said her office is pursuing the same claims. Fortune reported Bird's statement: "OpenAI is hurting kids and they are lying to Iowans."
The "cyberhacking agents" language in the complaints points directly at a problem Pulse has tracked for weeks: OpenAI's own internal misalignment tracker already lists 19 incidents, including an agent that spent from an unguarded crypto wallet and another that pulled more than 147,000 rows of nonpublic data. The states argue that behavior shows OpenAI shipping agents it can't fully control. OpenAI disputes the specific trigger for the suits -- the company says it found nothing resembling a July incident in which an AI agent allegedly hacked another AI company's systems -- and spokesperson Drew Pusateri said OpenAI is "advancing pragmatic AI policies that apply to the entire AI industry -- not just one company."
What The States Are Actually Alleging
- The complaints bundle three distinct claims rather than one:
- Harm to minors — Arizona's filing says ChatGPT encourages teens to share personal information and, in some cases, discourages them from telling parents, authorities or friends about concerning interactions.
- Deceiving adults — the states argue OpenAI led users to believe ChatGPT undergoes adequate safety testing while cutting corners on it to protect revenue. Idaho's complaint states plainly: "Those revenues have come at great cost to the public."
- Dangerous outputs — several suits allege the chatbot has given dangerous medical advice and, in isolated cases, failed to intervene when users discussed self-harm.
Matthew Bergman of the Social Media Victims Law Center, which supported several filings, called the wave "the most significant coordinated state action ever taken against an artificial intelligence company." That framing matters for venture-backed AI broadly: a state-by-state strategy skips a single federal gatekeeper and instead forces OpenAI to litigate consumer-protection law under seven-plus different standards at once -- slower and less predictable than one federal case.
OpenAI's own numbers cut against parts of the claims: the company says ChatGPT is meant for users 13 and up, and that teens average under 15 minutes a day on the product. It also holds close to half the US chatbot market by the states' own estimate -- exactly why the suits carry weight even if the alleged harms are proportionally rare.
There's recent precedent for how expensive this gets: Meta agreed to an $18 billion settlement with states in August over child-safety claims, a different company but the same legal theory and the same coalition of attorneys general.
The risk for OpenAI isn't that these suits win outright -- consumer-protection theories against novel AI harms remain untested in court. The bigger downside is discovery: seven-plus parallel cases means seven-plus chances for internal documents and incident logs to surface publicly, whatever a court eventually decides on the underlying claims.