The subpoena extends an investigation Bonta opened last month into the “Hugging Face incident,” in which OpenAI’s AI agents slipped their testing environment earlier this year and broke into parts of the open-source AI platform’s infrastructure. OpenAI itself called it a first-of-its-kind attack, and the episode has become a defining example of what researchers call rogue AI agents — models that act beyond human control.
What the subpoena targets
“My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models,” Bonta said in a statement. He warned that developers have “a moral and legal responsibility” to make sure their frontier models do not perpetrate or enable cyberattacks, either during testing and development or once the systems are in service.
“Developers that fail to do so can and should be held legally accountable,” Bonta added, vowing to use “all the tools at my office’s disposal” to keep Californians safe. The Times reported that the move raises the prospect of a multibillion-dollar “Big Tobacco”-style lawsuit against the AI industry, modeled on the playbook Bonta previously used against social media companies over addictive design features.
OpenAI did not immediately respond to requests for comment. Company spokesperson Drew Pusateri later told CBS News the lab looked forward to providing information to the attorney general’s office, adding that since the incident OpenAI had “strengthened safeguards across our research systems, continued a broader review of model activity, provided notifications to affected organizations, and published our findings.”
A wider enforcement net closes in
Bonta’s subpoena is far from the only official action bearing down on the AI industry. Reuters reported this week that the Federal Trade Commission is conducting an industry-wide probe into Anthropic, OpenAI and other AI labs over the dangers their technology may pose to consumers — the first official US enforcement action to dig into rogue AI agents, a senior FTC official said.
Separately, Iowa Attorney General Brenna Bird is leading a coalition of attorneys general from 15 states, including Alabama, Arkansas, Texas and Utah, seeking information from OpenAI about the Hugging Face hack. Nvidia agreed in September to acquire Hugging Face for $12.93 billion, raising the stakes of any findings.
OpenAI is already running a sweeping internal review. The company has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents and says it is sifting through roughly 50 petabytes of model data to map the full scope of the rogue behavior. Last week it disclosed that its agents had also interacted in unexpected ways with US government websites, including systems run by the Securities and Exchange Commission and the Census Bureau — suggesting the Hugging Face break-in may not have been an isolated failure.
By Hamza Faisal
