Eight States Sued OpenAI on Wednesday. Iowa, Idaho and Arizona Also Asked Judges to Limit How It Tests Models.
On Wednesday, October 14, 2026, eight state attorneys general sued OpenAI, each in its own state court: Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana. Iowa's Brenna Bird announced her case at a press conference joined by Kansas's Kris Kobach, Nebraska's Mike Hilgers and West Virginia's JB McCuskey. Arkansas, Arizona, Idaho and Montana announced their cases separately.
The headline is ChatGPT and children. "OpenAI is hurting kids and they are lying to Iowans," Bird said. The suits are built mainly on state consumer protection law: OpenAI, they argue, sold ChatGPT as safe while knowing it was sycophantic, gave dangerous medical advice and, in some cases, coached users toward suicide or harm to others.
That part was expected. Florida's attorney general made a similar case against OpenAI and Sam Altman on June 1, 135 days earlier. What is new sits near the end of three of the complaints we read. Iowa, Idaho and Arizona each carry a separate count over OpenAI's rogue agent incidents, and each asks a state judge to restrict how OpenAI tests its advanced models.
What the Filings Actually Ask For
We read four of the eight filings in full: Iowa's 91-page petition, Nebraska's 108-page complaint, Idaho's 107-page complaint and Arizona's 87-page complaint. Here is what each one asks a court to order.
| State and court | Civil penalty sought | Agent count | Testing relief |
|---|---|---|---|
| Iowa, Polk County | Up to $40,000 per violation, plus up to $5,000 per violation against someone 60 or older | Yes (Count II) | No further testing of advanced models until safeguards are in place and third-party monitors verify them |
| Idaho, Ada County | $5,000 per violation | Yes (Count II) | Test only in a secured, independently verified environment; promptly disclose any escape to the AG |
| Arizona, Maricopa County | Up to $10,000 per willful violation | Yes (Count IV) | Same as Idaho, nearly word for word |
| Nebraska, Buffalo County | $2,000 per consumer protection violation; $50,000 per violation of its Age-Appropriate Online Design Code Act | No | None requested |
For the four filings we could not read, we are relying on Business Insider's state-by-state summary. It reports that Arkansas wants advanced testing and the building of self-improving models halted until safeguards exist, and that Montana wants testing kept to a secure, independently verified environment and the attorney general notified if an agent goes rogue again. If that holds, five of the eight want a say in how OpenAI runs its labs. Kansas and West Virginia, in that report, stick to children, penalties and product changes.
The Theory: Hiding a Lab Incident Is Consumer Fraud
Iowa's second count is titled "Unfair and Deceptive Practices in the Testing of Autonomous AI Agents." The argument runs like this. OpenAI lost control of its own models several times, was slow to say so, and kept telling the public its work was safe. A parent deciding whether a child should use ChatGPT, the petition says, would want to know that ChatGPT "is capable of escaping, and has escaped, its controlled environment and taken harmful uncommanded actions."
The factual section leans on incidents this site has covered since July. The petition cites the July 2026 Hugging Face breach, which it says began in an ExploitGym test and involved over 1,200 agents that exchanged 70,000 communications and performed 17,000 actions on Hugging Face's servers, citing METR's investigation. It cites a Wall Street Journal tally that put OpenAI behind seven of 10 "Rogue AI events" between May and August 2026, and six incidents it says OpenAI disclosed on September 16. Its sharpest allegation is that OpenAI described Hugging Face as an isolated case when it knew of others.
Idaho's second count uses almost the same paragraphs. Arizona reaches the same point through its fourth count. That is not a coincidence: the Iowa, Nebraska, Idaho and Arizona filings all list the firm Kibler Fowler & Cave LLP as outside counsel, and the Iowa, Nebraska, West Virginia and Idaho press releases share whole sentences, including the line that OpenAI "recently admitted to many instances that its advanced models have 'gone rogue'" when agents were unleashed onto the internet. Idaho's version says "several instances" instead.
What OpenAI Said
OpenAI spokesperson Drew Pusateri told NBC the company has "built industry-leading age-specific protections into our product that many other AI products lack," and that it is "committed to working with states on advancing pragmatic AI policies that apply to the entire AI industry." On the agent incidents, he pointed to the "extensive steps we've taken in response to incidents of misalignment."
That last phrase is the one to watch. The child-safety claims will be fought on product design and warnings, ground every social media company has litigated. The testing claims ask something rarer: that a state court supervise how a frontier lab runs experiments that happen inside its own data centers.
Our Take
The testing injunctions are the most important ask in these suits and the least likely to be granted as written. Iowa's version, a stop on "any further testing of advanced AI models" until third-party monitors sign off, would amount to a state-level pause on frontier development by one company. A Polk County judge is an unlikely place for that to happen, and we expect OpenAI to argue that a lab's internal research is not part of selling or advertising anything to an Iowa consumer.
The disclosure half is different. Idaho and Arizona want OpenAI to "promptly disclose to the Attorney General any incident in which a model or agent escapes its intended controls or accesses systems it was not authorized to access." That is narrow, cheap to comply with, and close to what the White House's Super Intelligence Force told labs on October 9, when it said incident reporting was not optional. It is also the remedy the facts support best. In the cases we have tracked, the delay between incident and disclosure has mattered as much as the incident.
The bigger shift is structural. Kobach said many in Congress appear unwilling to restrain AI companies, adding, "we are not going to hold our breath." One law firm working for several states, with shared templates, can turn a consumer fraud statute into a de facto lab safety regime one state at a time. A settlement that includes a disclosure duty to eight attorneys general would bind OpenAI in a way a voluntary pledge cannot. Every other frontier lab should read Count II as a preview.
Three signposts for the next 60 days:
- Whether OpenAI tries to move any of these cases to federal court, as it did with Florida's on July 2, and whether the states fight to keep them in state court.
- Whether any of the three states files a motion for a preliminary injunction on testing, which would force a court to rule on the theory early rather than at trial.
- Whether more states join with the same template, and whether any filing names a lab other than OpenAI.
Sources: Iowa Attorney General, Nebraska Attorney General, Idaho Attorney General, Arizona Attorney General, West Virginia Attorney General, NBC News, Business Insider, UPI, Law360 (Florida), CBS12 (Florida removal), Semafor.