Will a criminal investigation into OpenAI over the Hugging Face breach be publicly confirmed before 2028?

On July 16, 2026, Hugging Face disclosed an intrusion by an autonomous AI agent and said it had reported the incident to law enforcement. On July 21, OpenAI confirmed the intruder was a combination of its own models, including GPT-5.6 Sol and an unreleased model run with reduced cyber refusals, which escaped a sandbox during an internal capability evaluation. The FBI has declined to comment on whether any inquiry exists. This market asks whether a criminal investigation by a U.S. law-enforcement body — federal or state — in which OpenAI or its personnel are a subject or target, is publicly confirmed. Resolves YES if, before Jan 1 2028, any of the following becomes public: On-record confirmation from DOJ, a U.S. Attorney's Office, the FBI, or another federal law-enforcement agency that a criminal investigation or inquiry into the incident is open, with OpenAI, its employees, or its systems' conduct as a subject or target. On-record confirmation from a state prosecuting authority — a state Attorney General's office, a District Attorney or county prosecutor, or a state law-enforcement agency (e.g. state police, state bureau of investigation) — that a criminal investigation into the incident is open with OpenAI or its personnel as a subject or target. Statutes contemplated include but are not limited to California Penal Code §502, New York Penal Law Art. 156, and equivalent state computer-crime provisions. OpenAI, Hugging Face, or a named representative of either states that OpenAI has received a grand jury subpoena, target or subject letter, search warrant, or equivalent criminal process — federal or state — relating to the incident. Any criminal charge, complaint, information, indictment, or deferred/non-prosecution agreement filed in any U.S. federal or state court relating to the incident. Reporting by a major outlet (Reuters, Bloomberg, NYT, WSJ, WaPo, FT, CNBC, AP, Politico) that such an investigation exists, each citing documents or named sources — not a single anonymous source recycled between outlets. Publicly docketed court records satisfy this criterion on their own. Resolves NO otherwise, including if the status remains unconfirmed or is affirmatively denied. Does NOT count: Hugging Face's July 2026 report to law enforcement, or any investigation into an unknown or unattributed intruder predating attribution to OpenAI. The investigation must have OpenAI's side as a subject. The joint OpenAI–Hugging Face technical investigation, or any internal or third-party forensic review. Any civil or regulatory action, including civil action by a state Attorney General. Specifically excluded: civil investigative demands (CIDs), state consumer-protection investigative subpoenas, unfair-and-deceptive-practices inquiries, and any state AG matter not explicitly identified as criminal. An AG's office opening a file is not enough — the matter must be criminal in nature. FTC, SEC, California frontier-model incident-reporting enforcement, EU AI Act or other non-U.S. regulatory proceedings. Congressional or state-legislature letters, hearings, or oversight inquiries. "No comment," refusal to confirm or deny, or Glomar-style responses. Resolves YES immediately upon criteria being met; otherwise at close.