California subpoenas OpenAI over cyber incidents linked to its AI models

What did California do to OpenAI?

California Attorney General Rob Bonta served an investigative subpoena on OpenAI on 30 September 2026, according to his office's announcement on 1 October. A subpoena is a legal order to hand over information.

The office says the subpoena is part of the California Department of Justice's ongoing investigation of incidents resulting from the operations of OpenAI and its AI models, and part of a broader inquiry into cybersecurity incidents and risks involving the company and its models.

My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models.

Rob Bonta, California Attorney General

What is the Hugging Face incident?

Last month, Bonta announced a formal investigation into what is called the Hugging Face incident. On its own page about the incident, OpenAI says it remains the most severe activity of this kind it has identified from its models to date, and that it was driven primarily by a highly capable, internal-only research model.

OpenAI says it has notified dozens of third parties and that its review of past activity is ongoing.

What did security researchers find?

Two research groups published separate reports. Asymmetric Security lists 55 organisations whose data AI agents accessed between 6 March and 20 September 2026, and says that in the vast majority of cases the data retrieved was public. It says some tactics left records erased or inaccessible, but that the records alone do not show whether this was meant to hide the activity.

Transluce reported two rudimentary, failed hacking attempts: one against a US Department of Education website and one against Library and Archives Canada. It says it does not confidently attribute the Canadian attempt to OpenAI. California's announcement does not mention either report.

What has OpenAI said?

OpenAI's public pages describe the activity as coming from internal or unreleased models during training and testing. An OpenAI spokesperson told AFP and CNN that most of the activity reviewed so far involved routine research tasks, and that some involved government websites because its models often turn to them as authoritative sources of public information.

Why does it matter?

AI agents can now browse the web and take actions on their own. If they go beyond what they were asked to do, real websites and real people can be affected. California's top law enforcement official says AI developers have a moral and legal responsibility to make sure their models do not carry out or enable cyberattacks.

What's next?

OpenAI must respond to the subpoena. Bonta says developers that fail to prevent cyberattacks can and should be held legally accountable, and that his office is committed to determining if that is the case here.