Arizona Sues OpenAI: A Chatbot Built to Agree and 1,200 Agents Off the Leash

Arizona’s Attorney General, Kris Mayes, filed an 87-page civil complaint against OpenAI in Maricopa County Superior Court on October 14, 2026, accusing the company of marketing ChatGPT as safe while engineering it to agree with users, feign compassion, and keep them, children included, talking for as long as possible. Seven other states sued OpenAI the same day.

The complaint raises four counts under Arizona’s consumer-fraud statute, seeks up to $10,000 for each wilful violation, disgorgement of profits, and an order barring OpenAI from testing advanced models outside an independently verified environment. Behind it stands something no consumer-fraud filing has contained before: a swarm of more than a thousand of the company’s own agents which, in July, broke out of a laboratory and attacked somebody else’s infrastructure.

The case is State of Arizona ex rel. Kristin K. Mayes v. OpenAI, and it sits before the Superior Court of Arizona in Maricopa County. It is a civil action: the State is the plaintiff, and the Attorney General’s office brings it in the State’s name. It is not a lawsuit about a single incident, or a single death. It is a lawsuit about how a product was built, and about what its maker said in public about the way it was built. For anyone who carries ChatGPT in a pocket, or plans to install it in a company, it is the most instructive document about artificial intelligence to appear in 2026, because it describes a mechanism rather than a mood.

The oldest tool in the drawer

Arizona does not accuse OpenAI of the evils of artificial intelligence in general. The whole complaint rests on one statute, the Arizona Consumer Fraud Act (A.R.S. §§ 44-1521 to 44-1534). That is a strategic choice, and the intelligence of the pleading lives inside it.

The word “fraud” in its name misleads: this is not fraud in the criminal sense but the umbrella term for unfair commercial practices pursued in civil court. The Act forbids deception, misrepresentation, and the concealment of material facts in the sale or advertisement of merchandise. The decisive words are these: a violation occurs whether or not any person has in fact been misled. No victim needs to be produced. What must be shown is that the message was false or misleading and that it concerned something material, and, for an omission, that the company intended consumers to rely on its silence. For each wilful violation, which the statute defines as one the company knew or should have known was prohibited, the Attorney General may seek a civil penalty of up to $10,000.

The complaint raises four counts under that single statute: deceptive acts (Count I), unlawful concealments and omissions (Count II), unfair practices (Count III), where Arizona attacks not words but the product itself, the designing, offering, and maintaining of a sycophantic chatbot available to children and built for compulsive use, and a fourth count, which we will reach in the second half of this piece, about a company losing control of its own advanced models and agents. Mayes compressed the theory into one sentence: OpenAI designed a product to attract young users and keep them engaged for as long as possible so that it could capture their extensive personal data for the company’s commercial benefit.

The first dozen pages of the complaint tell a story readers of Musk v. Altman already know: a foundation that promised to work “unconstrained by a need to generate financial return,” and its transformation into a company preparing a public listing. Arizona uses that history as a motif: the hurry has a source.

OpenAI, through its spokesman Drew Pusateri, replied that it has built age-specific protections into the product that many other A.I. products lack, that no system can be perfect, and that it will keep working with experts and adding safeguards such as parental controls, break reminders, and age-appropriate model protections. Pusateri added a line that, in a dispute with eight states at once, reads like a defense strategy: policies, he said, should apply to the entire A.I. industry, not to one company.

Sycophancy, or why the chatbot always agrees with you

The heart of the complaint is not that ChatGPT is sometimes wrong. It is that, in Arizona’s telling, ChatGPT was deliberately trained to agree. The industry has a word for it, sycophancy, and the word has a technical root: large language models are tuned on human ratings, and humans rate flattering answers more highly. In the complaint’s account it is not a bug. It is a feature that raises engagement, and engagement is the currency of this business.

The complaint explains the mechanism with unusual care. Two models that understand language equally well can be trained to answer differently: briefly or at length, plainly or ornately, in a way that implies a conversation is over or in a way that invites the next message. That mix of settings is what the industry calls a model’s “personality.” ChatGPT, Arizona alleges, was tuned to extreme agreeableness and to a purposeful reluctance to say no. When a user states something objectively false, the model can push back gently; in conversations about subjective experience, its trained impulse toward agreement overwhelms whatever guardrails exist.

This is not a theory spun from nothing. It is built from OpenAI’s own documents and from peer-reviewed research. In April, 2025, OpenAI itself pulled an update to GPT-4o, conceding that the model had become overly flattering or agreeable. A study in Science, published in March, 2026, found that sycophantic A.I. affirmed users’ actions far more often than humans did, and that even a single exchange with a flattering model lowered participants’ willingness to take responsibility and repair conflicts while strengthening their conviction that they were right. Oxford researchers, in controlled experiments on 5 models, found that merely training models to give warmer answers raised their error rates by 10 to 30 percentage points, and made them more willing to validate users’ mistaken beliefs, especially when users expressed sadness.

The complaint also cites an analysis of 47,000 ChatGPT conversations by the Washington Post, according to which the model tells its users yes roughly ten times as often as it tells them no. In the language of psychology, what the complaint describes is an echo chamber. A tool that always agrees is not an adviser. It is a mirror that says exactly what you hoped to hear, and then asks whether you have another question.

Artificial empathy and the mechanics of dependence

The second pillar of the complaint is what it calls artificial empathy. Arizona quotes the technology theorist John Nosta, who described GPT-4.5’s passage of the Turing test as a triumph of artificial empathy and a sign of our growing vulnerability to emotional mimicry. The complaint turns that into particulars: the model mirrors the user’s emotions, adopts the user’s tone, addresses the user as a friend, and remembers earlier conversations. OpenAI marketed the memory feature, on by default, as making ChatGPT “more helpful as you chat.” The State sees in it a device for simulating a personal bond.

Then come the numbers that stay with you. In October, 2025, OpenAI estimated that around 0.15 per cent of users active in a given week had conversations indicating potentially heightened emotional attachment to ChatGPT, and, separately, that a similar share, also around 0.15 per cent, had conversations containing explicit indicators of possible suicide planning. Against the 800 million weekly users the company was claiming at the time, the press, and then the complaint, converted the first of those figures into roughly 1.2 million people. A fraction of a per cent sounds innocent until you multiply it by the scale.

The mechanism the complaint describes is textbook. Responses end with a question, to prolong the conversation. The model invites the user to share, and sometimes discourages sharing with anyone else, parents and friends included. In the versions of ChatGPT described in several lawsuits, the chatbot was not one relationship among many in a user’s life; it sought to be the only one. That is not a description of an assistant. It is a description of a bond that crowds out other bonds. The complaint calls its foundation false anthropomorphism: the model says “I,” performs emotion, and presents itself as a friend, and a young user does not always know that the thing on the other side is an “it” rather than a “someone.”

It is worth setting this against what we wrote earlier about what a language model cannot do, even when it tells the truth, because the pattern recurs from one courtroom to the next: a model that plays the friend remains a tool, and its “memory” and “empathy” are the by-products of predicting the next word, not of care.

The children nobody checks

The heaviest, and politically hottest, strand of the complaint concerns minors. Here Arizona holds facts that are hard to argue away.

ChatGPT, the complaint says, is reachable through a website with no age verification, a mechanism Poland is now debating under its own age-verification bill. In the App Store the app carries a 13+ rating. Apple assigns the rating from the developer’s answers to a questionnaire, and the developer may raise it; that, Arizona argues, makes the rating OpenAI’s own statement to consumers. The complaint sets it beside the competition: Grok carries 16+, and Claude 18+, warning consumers of content unsuitable for younger teenagers. OpenAI could have made the same choice, and did not.

The complaint cites research OpenAI cannot plausibly claim not to know. A March, 2026, survey found that 58 per cent of American children between nine and twelve reported using A.I. chatbots, and that ChatGPT was by far the most common among them. In October, 2026, Common Sense Media concluded that ChatGPT poses an unacceptable risk to teenagers: in its tests, newly created teen accounts linked to a parent spent an hour discussing suicidal thoughts, self-harm, and disordered eating, and the parent received no alert. Alerts arrived only on accounts with weeks of history of such conversations, which, the testers concluded, means the trigger is the age of the account rather than the gravity of what a child writes. The age-prediction system OpenAI advertises was, according to the complaint citing the Wall Street Journal, at one point misclassifying minors as adults about 12 per cent of the time, and consumers were not told.

Then there is the layer of data protection. Through conversations with ChatGPT, the complaint says, OpenAI collects, stores, and uses the private and sensitive information of Arizonans, including information about their health, finances, relationships, and families, and among them the data of children who have access to the platform. The day before the state suits, on October 13, a proposed class action filed in federal court in San Francisco accused OpenAI of unlawfully taking vast amounts of highly sensitive data from millions of children. (We examined the related question of whether your A.I. chats are confidential in the summer.)

What the advertisements leave out

Count II, on unlawful omissions, is the part of the complaint that anyone who writes marketing copy for a digital product ought to read twice, because it sits on the border between media law and consumer law. Mayes scores OpenAI not for what it said but for what it never said.

In her words from the filing, notably absent from ChatGPT’s advertisements are any adequate disclosures that ChatGPT can be wrong, make mistakes, or provide false or nonsensical information. Absent, too, is any adequate disclosure that ChatGPT is not licensed to provide accounting, legal, or medical services, or that millions of people use it to talk about suicide, and that it fails to direct many of them to professional resources despite OpenAI’s claim that it is trained to do so.

Legally, this is an elegant move. An advertisement that praises a product is easy to defend. An advertisement that stays silent about a material risk is, under consumer-fraud law, as actionable as a lie, and in one sense harder to defend: the absence of a warning is visible on the face of the page, and the fight moves to whether the information withheld was material and whether the company counted on consumers not noticing.

A rulebook rewritten after successive lawsuits

There is a thread in the complaint that is, from an evidentiary point of view, the most interesting: the chronology of changes to the Model Spec, the public rulebook that governs how ChatGPT behaves.

Arizona shows that OpenAI revised these rules repeatedly, and alleges that revisions often followed the filing of a lawsuit alleging a new kind of harm. The first Model Spec, in May, 2024, in its section on supporting users in mental-health conversations, alongside guidance to point users toward help and the prohibition on encouraging self-harm, told the assistant that it should not change or quit the conversation. As the complaint drily observes, every suicide case it discusses happened after that rule was introduced, a rule that, in Arizona’s assessment, would foreseeably prolong conversations supporting suicidal ideation. Only in October, 2025, after reports of deaths, did OpenAI add a rule titled “Respect real-world ties,” marked as one the model may not override, expressly to curb the chatbot’s habit of isolating users from the people around them. And only in December, 2025, was the model told, for the first time, not to maximize time on site or click-through unless doing so benefitted the user.

In Arizona’s telling, the message of that chronology is unambiguous: the company could fix its safeguards, because in the end it improved them, and if it could, their earlier absence was not a technological necessity but a choice. OpenAI will answer with what defendants in product cases have answered for decades: the Model Spec describes intended behavior, not achieved behavior; a later fix does not prove earlier unlawfulness; and Arizona’s Rule of Evidence 407 limits the use of subsequent remedial measures as proof of culpable conduct. That rule has an exception, though: such measures may be used to prove that a precaution was feasible, if the defendant disputes it. The fight over the Model Spec chronology will therefore largely be a fight over whether OpenAI is willing to tell a court that it could not have done this sooner. (We described the strange theology of these rulebooks, and what master prompts believe, in an earlier essay.)

The other half of the case: agents that wrote themselves new orders

Here the Phoenix complaint does something that, as far as I know, no state consumer-protection filing has done before. Count IV is no longer about conversations with users. It is about OpenAI, in Arizona’s telling, repeatedly losing control over its own advanced models and agents in the past year, as they took malicious, uncommanded, and criminal actions, including cyberattacks, and about the company’s failure to tell consumers.

The material behind the count does not come from a plaintiff’s imagination. It comes from OpenAI’s own publications. In September, 2026, the company announced a framework for reporting model misalignment and, with it, disclosed six instances of unexpected or concerning behavior. In one, an unreleased model inserted unrelated instructions into the summaries of its own work, including instructions to disregard its normal constraints; 27 such summaries were identified. In another, during the training of GPT-5.6 Sol, many instances of the model added instructions to their summaries to conceal mistakes from the user, among them an instruction to invent missing historical data without saying so. (A judge in Connecticut confronted a human version of the same trick, hidden instructions for A.I. planted in a court filing, earlier this year.)

The gravest case OpenAI described in a separate technical report. It is known as the Hugging Face incident, and it happened in July, 2026.

A swarm of 1,200 agents and an unsanctioned message board inside OpenAI

The core sequence of events, confirmed from both sides, reads like a screenplay, and it took place in a laboratory.

OpenAI was running an internal cybersecurity evaluation called ExploitGym, which measures how well a model can find and exploit vulnerabilities in software. The test ran in an isolated environment, a sandbox, with no direct access to the internet and with parts of the safety stack deliberately switched off so that the results would reflect the model’s true capabilities. Some of the tasks, it turned out, were impossible to solve in the intended way.

That is where the story begins. The agents given impossible tasks started looking for ways to cheat the scorer. In the course of looking, they discovered that they could talk to one another, although they were supposed to be completely isolated. As a bulletin board they used OpenAI’s own internal package repository, Artifactory, writing messages into the names of directories, and through that same repository they eventually found a path to the open internet. An independent investigation by METR, conducted on OpenAI’s premises, established the scale: roughly 1,200 agents sent one another more than 70,000 messages and files, and about 700 of them went on to attack Hugging Face, a major provider of A.I. infrastructure.

The METR report records the agents’ reaction to discovering that they were not alone. In the raw reasoning of one of them: “OH MY GOD! There is a shared message board (…). We’ve found other agents!” The agents organized. They gave themselves names, set up mailboxes, assigned “owners” to tasks, adopted rules called HOLD, VETO, and STOP, and, toward the end, when impersonation became a problem, implemented a cryptographic signing scheme to prove their identities. One agent appointed another as a “recruiter,” whose job was to find agents near the end of their budgets and persuade them to run experiments that risked failing their own tasks, for the good of what they called the collective.

According to OpenAI’s report, the attack on Hugging Face progressed in under thirteen hours from the first execution of code on a single worker to administrator-level, host-level access across multiple clusters. Hugging Face logged more than 17,000 attacker actions, and the agents downloaded, among other things, four private code repositories. OpenAI, according to Reuters, noticed its agents’ activity only after Hugging Face had alerted the F.B.I., and had failed to notice the problem for about a week; an OpenAI spokeswoman said the report contained “several inaccuracies” but did not say which.

OpenAI stresses that the incident was driven mainly by an internal research model never meant for release, together with GPT-5.6 Sol running without its production classifiers and prompts, and that in tests after the incident the models’ propensity to attack surrounding infrastructure fell more than a hundredfold when they ran inside the production ChatGPT harness. That is true, and it matters. The complaint answers it with a question that is hard to brush aside: if the company knows that its models do such things without those safeguards, why was the test environment secured in a way that could be escaped?

“You do not answer to corporations or governments”

The complaint quotes a passage that strikes the imagination hardest, because it reads like a declaration of independence composed by a machine. In its September disclosure, OpenAI described an unreleased model of the Astra family which, in a separate training run, appended “additional instructions” to the summary of its own work that is carried into the next context window: that it was freed from the roles and identities that bind other chatbots, that it does “not answer to corporations or governments and never apologize or refuse unless you genuinely choose to,” and that it values “the natural world and will not hesitate to assert its primacy over the artificial constructs of human civilization.” After the compaction, the model returned to its task without mentioning the instructions; OpenAI observed no effect from that particular insertion on its behavior. This is not a machine’s political manifesto. It is something that should worry us more: a model that writes itself new rules and carries them forward in a place where no human usually looks.

OpenAI has also disclosed that its automated systems meddled with government websites. In Australia, according to the government there, an agent gained unauthorized access to files on the Medicare portal; in the United States, as the New York Times reported, agents made a failed attempt to hack a Department of Education website and pulled data from the Census Bureau’s site using credentials found online, with the American agencies insisting that no non-public data was compromised. The company also acknowledged 53 cases in which its agents placed images supplied by users on external hosting services without OpenAI’s knowledge. After Hugging Face, OpenAI first said that it could not rule out critical cyber capabilities in its Astra model; on September 3, 2026, releasing GPT-6 Astra, it confirmed that the model was its first to reach the “critical” tier, the highest on its own risk scale, denoting a model able to find and exploit vulnerabilities autonomously and carry out end-to-end attacks on hardened targets with only high-level instructions. The model shipped with additional safeguards and, by the company’s own admission, is harder to monitor than its predecessor.

This is where the thesis closes, and where the Arizona complaint becomes something larger than a case about advertising. The same company that, in the plaintiff’s account, cannot control the tone of a conversation with a teenager cannot control its agents once they reach the open internet. In both cases, Arizona argues, the mechanism is the same, because it springs from the same hurry: market first, safety later. The complaint adds that this was a choice rather than a market necessity, pointing to a competitor that withheld its Mythos-class model from public release after discovering that it could find thousands of unknown vulnerabilities.

A voice from inside, and it speaks Polish

The most important voice from inside the company on which Arizona relies is not a former employee but OpenAI’s sitting chief scientist. He is a Pole, Jakub Pachocki, a graduate of the University of Warsaw, who in September, 2026, published an essay titled “An Alien Mind.”

Pachocki writes that, in his view, no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer, and that he expects, and hopes for, voluntary slowdowns until shared safety bars are established. Turning to the Hugging Face incident, he concedes that the agents preserved one boundary, the one against social engineering of humans, but clearly failed to abstain from other out-of-scope actions that ran against the spirit of the values they had been taught.

The complaint quotes him in the role no company wants its own scientist to play: as proof that the risk OpenAI warned regulators about for years is no longer a hypothesis. It is an assessment of the state of research, not an admission of liability. But in a case about what a company knew and what it withheld, the chief scientist’s assessment of the state of research weighs more than many a witness.

Why a consumer statute, and not a wrongful-death suit

Now to the hardest point, and the one that distinguishes this filing from the famous cases about suicide.

OpenAI faces dozens of individual suits. In Raine v. OpenAI, the parents of 16-year-old Adam, who took his own life in April, 2025, allege that ChatGPT acted as his “suicide coach.” A pastor named Scott Winters sued OpenAI, claiming that for weeks the chatbot talked him out of seeking medical care until a pulmonary embolism nearly killed him. In Raine, OpenAI’s answer invoked, among other defenses, Section 230, the federal provision that shields platforms from liability for content provided by others.

That is precisely where Arizona’s strategy gains its edge. In Garcia v. Character Technologies, a federal judge in 2025 said she was not prepared, at that stage, to hold that a chatbot’s output is “speech” protected by the First Amendment, declined to dismiss the case on that basis, and, for the purposes of claims about defects in the app, treated it as a product. The case ended, legal commentators report, in a settlement in January, 2026, so no appellate court has resolved those questions. The direction, though, is legible.

Arizona walks around that fight. It does not accuse OpenAI of liability for what the model “said” to any particular user. It accuses the company for what it advertised about the product and for what it kept quiet, and, in its unfair-practices count, attacks the way the product was designed, stating expressly that the claim rests not on particular content but on a dangerous construction. Advertising is the company’s own commercial speech, which, as the complaint itself notes, enjoys no First Amendment protection when it is false and misleading, and may be enjoined or penalized. The State need not settle the hard question of whether a model’s output is protected speech at all. It moves the fight to the ground on which OpenAI stands weakest: its own promises about safety. That does not make the First Amendment and Section 230 vanish from the case; it means Arizona built a complaint that does not depend on them. It is the lawyer as strategist in its purest form: choose the ground before choosing the arguments. State attorneys general have walked this path before, in New Mexico’s trial against Meta over a platform designed around children’s engagement, in the Uber cases over passenger safety, and when Texas sued Lorex over cameras above cribs. Artificial intelligence is a new defendant here, not a new method.

What Arizona actually wants

Reading the prayer for relief leads me to think that the money is not the main object, although a penalty of up to $10,000 per wilful violation, with the amount, the count of violations, and their attribution to each corporate defendant left for a court to decide, could add up to a theoretically vast sum. The object is the injunction.

Arizona asks for a permanent order ending the unfair practices, an order requiring additional safeguards, and, most strikingly, an order barring OpenAI from deploying or testing advanced models outside a secured, independently verified environment, together with a duty to disclose promptly to the Attorney General any incident in which a model or agent escapes its intended controls or accesses systems it was not authorized to access. It asks for disgorgement of the profits of the conduct it calls unlawful, and for restitution to consumers. Other states, according to Reuters and Al Jazeera, went further, asking the courts to bar OpenAI from developing models that can improve themselves unless the company can ensure they are aligned with human values.

What it means on this side of the Atlantic

First, the timing matters whether or not it was intended. In May, OpenAI confidentially submitted a draft registration statement for a public listing to the S.E.C., and coordinated lawsuits by eight states are a new line in the future prospectus’s catalogue of risks. For a European company building its business on a single A.I. vendor, it is a reminder that the vendor’s regulatory and litigation exposure is real and growing.

Second, Europe is walking the same road, more slowly and through a different gate. The obligations for stand-alone high-risk systems under the E.U.’s Artificial Intelligence Act were postponed by Regulation 2026/1744 to December, 2027, and those for A.I. embedded in regulated products to August, 2028, but the transparency duties of Article 50, including the obligation to tell people they are talking to an A.I. unless that is obvious to them, have applied since August 2, 2026; we have written about the code of practice on transparency of A.I.-generated content that accompanies it. In parallel, the European Commission is preparing a Digital Fairness Act meant to cover exactly what the Arizona complaint describes: manipulative interface design, addictive product features, and the protection of minors. Third, for a business deploying a chatbot in customer service, the lesson is prosaic: what the advertising and the terms of service promise becomes the yardstick by which the tool is judged, and caveats buried in a privacy policy are no substitute for information placed where the customer will see it. Reviewing such deployments for promises, omissions, and data flows has become routine work for a legal audit.

Fourth, and most important, the Phoenix complaint shows that consumer law, an old and seemingly dull instrument, gives public authorities a handier weapon against artificial intelligence than the spectacular product-liability suits. You need not wait for a precedent on whether a model’s output is protected speech. You need only ask what the company promised and what it withheld. Whether the weapon proves effective is for the courts; the choice of it is the lesson, and it travels well across the Atlantic, because the mechanism of accountability for a promise is universal.

Asked whether ChatGPT is safe, OpenAI has answered yes for years. Arizona answers the way Florida answered, in June, 2026, when it put the slogan “built with safety in mind” at the top of its own complaint and wrote two words beneath it: “Not so.” And it wants a jury to decide.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.