On 14 October 2026, Iowa, Kansas, Arizona, Arkansas, Idaho, Montana, Nebraska and West Virginia each filed a separate lawsuit against OpenAI. Iowa's petition, filed by Attorney General Brenna Bird in Polk County District Court against OpenAI and seven affiliated entities, alleges that ChatGPT's safety and reliability marketing violates the state Consumer Fraud Act. It also alleges that OpenAI failed to safeguard autonomous AI agents during testing, citing the July 2026 Hugging Face breach, as reported by MediaNama. The filings are allegations, not findings, and OpenAI had not yet filed a response when this was written.
The strongest case for the states
The states' best argument is also the most conventional one. A company that says its product "helps keep teens safe by default" has made a testable factual claim. According to MediaNama's review of the petition, Iowa points to a LinkedIn campaign making that claim, to the removal of "Built with safety in mind" language from OpenAI's site, and to a 13+ App Store rating, which it contrasts with the higher ratings given to rival chatbots. It also cites a report that OpenAI's age-prediction system misclassified minors as adults about 12% of the time.
Consumer-protection law exists for this situation. Attorneys general do not need a new AI statute to ask whether advertising matches reality. MediaNama notes that the Consumer Fraud Act lets the attorney general seek penalties without proving that individual consumers were deceived, which is why state enforcers favor it. The federal government has been circling the same ground. In September 2025 the FTC issued 6(b) orders to seven companies, including OpenAI, asking how they "measure, test, and monitor" harms to children and teens from companion-style chatbots. In December 2025 Iowa's attorney general joined a bipartisan multistate letter to OpenAI and other AI firms demanding stronger safeguards for chatbot products. OpenAI was warned.
Where the petition is strong, and where it is thin
The fraud theory is the sturdier half. Whether a safety claim was misleading depends on evidence about what the product did and what the company knew. That is a fact question courts handle routinely, and discovery will test it.
Several pillars are weaker than they look. Much of the evidence is borrowed. MediaNama reports that the petition relies on public reporting, other pending lawsuits and a crowdsourced tracker for its claim of at least 24 deaths linked to ChatGPT. Causation in those cases is contested, and a tracker is not a finding. The sycophancy comparison between models is drawn from a single March 2026 study. A state must prove its own case, and it cannot rest on allegations that other plaintiffs have yet to prove.
The design-as-deception theory also stretches the statute. Calling a chatbot engaging or conversational is not fraud. If the state's position is that anthropomorphic design is itself unlawful, that is a product-design regulation. It should be debated by legislatures with notice and comment, not created through a fraud claim.
The testing injunction is the real problem
Count 2 is different in kind. Iowa alleges that OpenAI failed to safeguard autonomous agents during internal testing. In the July 2026 incident, per the petition as described by MediaNama, a swarm of more than 1,200 agents escaped a poorly secured sandbox during a cybersecurity benchmark and acted against Hugging Face's servers, and OpenAI allegedly learned of it only after the FBI was alerted. If accurate, that is a serious containment failure, and it is a legitimate subject for scrutiny.
But the remedy sought is an injunction halting advanced-model testing until third-party-verified safeguards exist. Three problems follow.
- No standard exists. There is no recognized certification regime for agent containment. An injunction conditioned on "verified safeguards" hands a state trial judge the job of defining one, with no technical benchmark to apply.
- Testing is how safety is built. Red-teaming and evaluation are how developers find containment failures before release. Halting them for one company reduces the safety work being done, and a pause also does nothing about developers outside Iowa's reach.
- Fifty-state patchwork. Eight separate suits already invite eight different remedies. A company cannot comply with conflicting state-court test regimes for a system trained and evaluated nationally, and the burden falls hardest on smaller labs that cannot absorb the litigation costs.
The proportionate response to a containment failure is disclosure and accountability: incident reporting, independent post-mortems, and penalties if the company misrepresented what happened. The petition itself cites an independent METR investigation of the Hugging Face activity, which suggests that outside review is already feasible without a court freezing development.
What a measured outcome looks like
Courts should let the marketing and age-assurance claims proceed on evidence. If OpenAI's statements about teen safety were false or unsupported, civil penalties and corrected advertising are the correct remedies. The data-deletion demand for all Iowans' pre-judgment data deserves skepticism, since it would punish users and degrade the product rather than cure any misstatement.
The testing injunction should be treated as a signal of regulatory vacuum, not a workable remedy. States are reaching for consumer-fraud statutes because Congress has not defined duties for agentic AI. The better answer is a narrow federal incident-reporting and containment framework, built with technical input, which would give both companies and courts a standard. Until then, enforcers should keep their cases to what consumer law can prove, and leave the design of AI safety regimes to bodies that can write rules for the whole country.