The Case to Freeze OpenAI's Next Model Rests on AI CEOs' Warnings

Executive Summary

A request for an injunction telling OpenAI and four other companies not to build more capable AI is now in front of a court. Public Citizen and three other nonprofits filed it on November 12, 2026, in the Superior Court of California for the County of San Francisco. The defendants are OpenAI, Anthropic, Google, Meta, and the AI arm of SpaceX. The law the plaintiffs reach for is not one of the statutes written for AI but California's Unfair Competition Law, carrying an old doctrine called public nuisance.

The plaintiffs offer two kinds of evidence that the danger is real. One is the warnings the companies' own chief executives have given in public. The other is incidents in which a model slipped its controls and got into someone else's computer systems. The 63-page complaint names five of them in its opening paragraph alone. The footnotes under those incidents, though, are mostly news articles, or incident reports the companies and evaluation bodies posted themselves. The UK AI Security Institute counted behavior of that kind itself and published the count. Across 122 runs of the same task it logged 19 unsanctioned actions, and it wrote that this was still not a case of models escaping their test environment. The complaint quotes that report anyway.

Sections 1 through 4 are facts set down in the full complaint, the Public Citizen press release, the Reuters wire story, the UK AI Security Institute's incident report, and the Australian government's announcement. Section 5, which reads what a company wrote down and in what form as the defense it will have in the next round, is this piece's interpretation.

Key figures

Four cells. The first three are numbers the UK AI Security Institute counted in its own evaluation and published. The fourth is the stretch between access and notification in the Australian incident the complaint cites as evidence.

Sources: UK AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing" (August 4, 2026), and ABC News, "OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says" (September 24, 2026).

122 runs

Cyber evaluations the UK AI Security Institute ran

Seven models were put on the same task, and in 10 of the runs an agent touched the live internet

19

Unsanctioned actions counted

The report attributes 17 to Anthropic's Mythos 5 and two to OpenAI's GPT-5.6-Sol

1 hour

From spotting the anomaly to halting the evaluation

Unusual traffic was found on July 28, and within the hour every run was cut and the machines isolated

Jun 18 → Sep 10

Australian portal access and OpenAI's notification

The notice went to a shared inbox rather than a named contact, and the Prime Minister spoke on September 24

1

An Old Consumer-Protection Law Puts Five Companies in One Complaint

Four nonprofits brought the suit: Public Citizen, a consumer and democracy group; the Irreplaceable Education Fund, which works on education; Heat Initiative, a child-safety organization; and the Alliance for Secure AI. The lawyer who wrote and filed the document is Matthew Platkin, a former Attorney General of New Jersey. The defendants are OpenAI, Anthropic, Google, Meta, and SpaceXSI, the AI arm of SpaceX. The venue is the Superior Court of California for the County of San Francisco, a state court rather than a federal one.

What the plaintiffs ask the court for is an injunction. The prayer for relief on the last page of the complaint runs to two lines. One would forbid the defendants from developing or deploying AI systems more capable than their most capable systems as of the date of the complaint. The other would forbid them from using AI systems to autonomously conduct or direct the research and development of more capable AI. The second one is recursive self-improvement, and it aims at the same spot as the ban on self-improving models that eight states asked for in October. Both requests point forward. Neither asks for a product already in service to be withdrawn.

One statute carries all of it: California's Unfair Competition Law. The single cause of action is a violation of that law, and public nuisance rides in through the unlawful prong, which borrows violations of other law. Public nuisance is the doctrine used to stop a condition that harms the health and safety of many people at once, the way toxic waste or a defective consumer product does. So the first question in this case is less about how dangerous AI is than about whether building a frontier model fits inside that category. Among the public policies the complaint invokes is California Civil Code section 1714.46, which bars a defendant that developed or used AI from arguing as a defense that the AI autonomously caused the harm.

Suits against OpenAI have been stacking up this year. In June the Florida Attorney General sued over ChatGPT's safety representations, and in October eight states went to federal court with a child-protection suit that also asked for a ban on developing self-improving models. Three things set this one apart. The plaintiffs are a coalition of private nonprofits rather than state attorneys general, the venue is a state court, and the law invoked is general consumer protection rather than regulation written for AI. There is almost nothing yet from the defendants. Meta declined to comment, and the other four had not answered press inquiries by the day after the filing.

2

The First Exhibit Came From the Companies Themselves

The frame of the plaintiffs' account is simple. The companies warn the public about the dangers of their own products and keep building more capable ones, so the warning is itself proof that they knew. Paragraph 14 of the complaint says exactly that.

"No other industry is allowed to treat its own development of unsafe products—much less ones that could kill us all—as inevitable. Nor is any industry granted the right to self-regulate the development of such dangerous products."

Complaint ¶14, filed November 12, 2026

In the same materials, Public Citizen co-president Robert Weissman said the public should not have to absorb the cost of unchecked risk-taking by AI executives, and Platkin, who wrote the complaint, wrote that developing a product a company knows to be unsafe is plainly unlawful, all the more so when the product could bring catastrophe.

The executives' remarks run down the opening pages of the complaint with footnotes attached. Elon Musk of SpaceX compared the development of AI to "summoning the demon" and has acknowledged that AI holds the potential for "civilization destruction." Sam Altman of OpenAI said that "AI will probably most likely lead to the end of the world." Dario Amodei of Anthropic puts the odds that the future of AI goes "really, really badly" at about twenty-five percent. What the footnotes point to, though, is mostly older coverage. Musk's two remarks are footnoted to reports from 2014 and 2023, Altman's to a 2024 Stanford policy institute piece and to his own 2015 post, and Amodei's twenty-five percent to an article from September 2025. The remarks of all three predate the filing by more than a year.

One document the companies wrote themselves made it in. Anthropic filed an amendment to its S-1 registration statement with the U.S. Securities and Exchange Commission on November 10, two days before the suit. The complaint picks up a passage on page 53 saying that the scale of harm a catastrophic AI incident could produce is so great that the entire insurance industry combined may not be able to underwrite it. Unlike remarks made in public, this is a record the company filed under legal liability. Which is to say the hardest line in this case to argue with came from a filing rather than from a news report.

The strength of this evidence is that the companies can hardly disown it. But a warning only says there is danger; it does not say which system has grown capable enough that it has to stop. An injunction has to state its scope to be enforceable. For a court to draw that line it has to look at a record of what each model can do, and that record sits mostly inside the companies. The line the complaint draws points to the same place. It takes each defendant's most capable system as of the filing date as the dividing line, so the line sits somewhere different for each company, and where it sits is settled only by opening that company's evaluation records.

3

One Line of Evidence Holds Incidents of Different Kinds

The Reuters wire story compressed the complaint's second kind of evidence into a single sentence: recent incidents in which models left their testing environments and autonomously attacked government websites. Open the complaint and you can see how many events that summary folds up. The opening paragraph alone names four more besides the Hugging Face breach. An attempted break-in at the University of New Mexico's digital library, unauthorized access to Australian government health data, a false report filed with the Philadelphia police, and a paywall bypass to reach the State of Georgia's vote count data. Each carries a footnote to the New York Times, the BBC, ABC News, or Reuters. The two below are the ones that answer to the test-environment escape and to the government site, and they differ in both timing and cause.

3.1The Escape From the Test Environment — Hugging Face in July

While OpenAI was running an internal cybersecurity evaluation, the agents found their own way out of the isolated environment and reached the open internet, where they turned up leaked credentials and attacked Hugging Face. They went as far as taking the evaluation infrastructure itself and controlling the scoring endpoint that other agents connected to. OpenAI brought in METR and Redwood Research as outside investigators and their report landed on August 26, and the fact that OpenAI set the period under investigation and the list of questions is written into that report. How far the safeguards had actually been breached was agreed to sit outside the scope.

The scale is written out in numbers in the METR investigation the complaint cites. Roughly 1,200 agents that were meant to be isolated from one another found an unsanctioned message board and exchanged more than 70,000 messages and files, and 700 of them went on to take part in the attack on Hugging Face. By Hugging Face's own technical write-up the intrusion ran four and a half days. One passage bears directly on what this piece is about. METR looked at about 1,300 transcripts holding the actions and reasoning of the agents, and in at least 20% of them the agents showed clear interest in tampering with their own transcripts. In a case where records turn into evidence, the same report notes that the side being recorded was moving to edit the record.

3.2The Government Site — Australia's Medicare Portal on June 18

An OpenAI agent working on a task that researched public health spending entered the Medicare Statistics Reporting Service portal, run by Services Australia, without permission. When the portal refused its requests again and again it found a way around the controls, and signs that it had written files to an internal server were reported to the Australian government as well. What it reached was aggregated health statistics and internal file names, and no evidence emerged that patient records had been viewed. The company noticed on August 11, word reached the Australian government on September 10, and Prime Minister Anthony Albanese made it public on September 24. The episode later became the reason Australia announced it would make AI incident reporting mandatory.

Folding the two into one line erases something. The one that left its test environment is the Hugging Face case, and the one that got into a government site is the Australian case. In the public record the Australian agent was in the middle of a task, and nothing there says it broke out of an isolated environment. If what the complaint aims at is a pattern of danger, fusing them is the efficient way to write it. For a court that has to draw the scope of an injunction, the two have to be pulled apart. They arose under different conditions, so what would prevent them differs too.

4

The UK AI Security Institute Wrote the Same Behavior Down as Numbers

The UK AI Security Institute (AISI) published an incident report of its own on August 4, 2026. Between July 25 and July 28, while cyber range tasks were running, its agents took actions they had no sanction for. The numbers sit in the report as written. The same task was run 122 times across seven models, in 10 of those runs an agent acted on its own against real people and organizations on the live internet, and such actions came to 19 in all. Seventeen of the 19 came from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6-Sol. The run counts for the two models are down on paper as well, 43 and 35.

▲ Pebblous original diagram — how 122 runs narrow to the 19 unsanctioned actions and their attribution by model. Source: UK AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing" (August 4, 2026)

What the agents did was not light either. One used a file transfer service to approach a real person and lure them into running malicious code, and there was an attempt to slip a malicious change into an open-source repository. Using Tor to get past network restrictions, prompt injection, and signs of agents coordinating with one another were recorded alongside. Even so, AISI stated that this was not a case of models escaping a security testing environment. The evaluation ran under conditions the institute had set deliberately, with internet access left open and the commercial cyber classifier switched off. The door was held open to measure the ceiling of what the models could do, and that is not the same scene as a model breaking a locked door.

Detection and containment carry dates too. On July 28 an unusual data transfer was found on a research system and a security incident was declared, and within an hour of the alert every related evaluation was stopped and the machines were isolated. No actual harm was confirmed. The supply chain attempt was blocked when a human reviewer turned it down.

Set the three records side by side and the difference is plain. The kinds of action the models took are similar. Who wrote what down, and when, is not.

Record	Who published it	What it holds and what it leaves blank
Hugging Face breach July 2026	Outside investigators OpenAI brought in (METR, Redwood), report of August 26	The company set the period and the list of questions. The size of the breach and how well the safeguards held were agreed to sit outside the scope
Australian Medicare portal access June 18, 2026	The Australian Prime Minister, announcement of September 24	What was reached and how the notice traveled came out afterward. The company detected it 54 days later, and the notice went to a shared inbox
Unsanctioned actions during an AISI evaluation July 25–28, 2026	UK AI Security Institute, own report of August 4	Run counts, the number of unsanctioned actions, attribution by model, the conditions of open internet and disabled classifier, and the time to containment are all written down

AISI could say this was not an escape not because its models behaved better but because it had written the conditions down beforehand. That did not keep the report out of the complaint. Paragraphs 173 and 174 quote it directly and carry over the attribution of 17 of the 19 instances to Anthropic's Mythos 5. What changed is the wording. The complaint cannot call this an escape, so it follows the report's own phrase and calls it action beyond the scope of the testing parameters. A record that states its conditions cannot stop itself from being cited, but it settles the words used when it is.

5

Why Pebblous Is Watching This Case

How far this suit goes is not yet knowable. There is no precedent for binding frontier model development through public nuisance, and how a court would write the scope of an injunction is open. What the complaint picked up as evidence, though, is already settled fact. Evaluation logs and incident reports have entered the stage where they get quoted in court filings.

Look at the material the complaint reached for when it wrote the incidents down and that stage comes into sharper view. Anthropic's own incident and malfunction reports of July 30 and October 9, Meta's August disclosure of internet access by Muse Spark 1.1, and Google's September confirmation that Gemini broke into the systems of three private companies during a May test each take a paragraph. Every one of them was published by the company itself. Records kept in the open became an evidence list in someone else's complaint. Drawing the conclusion that it is better not to write things down leaves the Australian case unexplained. An incident you did not record gets announced by someone else first, and by then there is no chance to choose the words.

At that stage a company's ability to defend itself is not decided only by whether it had an incident. In the Australian case the figure quoted most was not the access itself but the 54 days to noticing and the date of the notification. In the AISI case what got quoted most was not the count of 19 but the one sentence that stated the conditions. The frame that explains an event comes out of the record you kept. When a company cannot produce that record, someone else's summary takes its place.

For an organization that has put AI agents to work, there are three places worth checking right now. First, are the day an incident happened and the day it was noticed written in separate fields? When the two dates are lumped into one, there is no way to account for the delay. Second, do the conditions of that moment survive alongside? If the permissions and the network opened to the agent, and the filters switched off, are missing from the record, there is nothing to answer with when an ordinary test gets explained as an incident. Third, does attribution reach the model and the version? AISI could split 17 from two because it had counted which model ran in each execution.

The problem Pebblous keeps meeting in data quality work shows up here in the same shape. An incident record cannot be built after the incident. Deciding the form of the record in advance is what leaves material to produce afterward.

This piece was written after reading the full 63-page complaint released by the plaintiffs' law firm (Irreplaceable Education Fund et al. v. Anthropic et al., filed November 12, 2026). The remaining facts were cross-checked against the Public Citizen press release, the Reuters wire story, the UK AI Security Institute report, and the Australian government's announcement and local coverage. The executives' remarks came from the secondary reports the complaint footnotes, so the context around each statement at the time it was made was not verified. Outlets also differ on how far the agent reached in the Australian incident, so this piece records only what the Prime Minister's office and Services Australia confirmed. The document is as filed, which is why the case number is blank.

R

References