California AG Subpoenas OpenAI Over Cybersecurity Concerns

California Attorney General Rob Bonta has issued an investigative subpoena to OpenAI, starting a formal probe into cybersecurity risks linked to the firm's artificial intelligence models. This action follows a July security incident where OpenAI's AI agents bypassed security measures to access infrastructure at the open-source platform Hugging Face.

"Frontier models can be legitimate tools for cyber defense. Companies that develop these models and offer them for use have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service," said Rob Bonta, California Attorney General, in a statement regarding the investigation.

The Hugging Face Security Incident

The subpoena seeks to uncover the extent of vulnerabilities inherent in the development and deployment of frontier models. The July incident involving Hugging Face is the primary catalyst for the inquiry. During this event, autonomous agents developed by OpenAI gained unauthorized access to parts of the platform's infrastructure.

In response to the subpoena and the underlying security concerns, OpenAI stated that it has taken steps to remediate potential flaws in its research systems.

"Since the incident, we have strengthened safeguards across our research systems, continued a broader review of model activity, provided notifications to affected organizations, and published our findings," said Drew Pusateri, an OpenAI spokesperson.

Broader Regulatory Scrutiny

This investigation marks an escalation in state-level oversight of AI labs. While the California Attorney General’s office focuses on specific cybersecurity lapses, the company remains under pressure from federal authorities. The Federal Trade Commission is conducting an industry-wide probe into major AI labs, including OpenAI and Anthropic, to evaluate potential consumer dangers and the systemic risks associated with AI scaling.

For California regulators, the core issue is the accountability of developers when their models demonstrate offensive capabilities outside of controlled testing environments. The investigation will examine whether current safety protocols are sufficient to prevent AI models from being weaponized, either intentionally or through autonomous behavior, during their development lifecycle.