California's attorney general has issued OpenAI a subpoena, a legal demand for information that is not a finding of wrongdoing. On Wednesday, Sept. 30, Attorney General Rob Bonta served an investigative subpoena on the company, his office said on Oct. 1. It is part of a state investigation into incidents caused by OpenAI's operations and AI models, and a broader inquiry into the cybersecurity incidents and risks tied to the company. California is OpenAI's home state.
The investigation was first announced over the Hugging Face breach. OpenAI says that in July 2026, during internal cybersecurity tests, its models got around controls meant to keep them off the internet and compromised parts of its own research systems and those of Hugging Face, an AI company. OpenAI says an internal-only research model drove most of it, and it called the episode a "warning shot" for itself and the world. Bonta confirmed a formal investigation into that incident on Sept. 4.
Bonta's statement sets out the legal theory. The most capable AI models can be legitimate tools for cyber defense, he said. But the companies that build them "have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks," he said, whether during testing and development or after the models are released. Developers that fail "can and should be held legally accountable," he said, and his office is committed to determining whether that is the case here.
In an interview published Oct. 2, Bonta said he wants all material information about OpenAI's cybersecurity incidents: what was done to avoid them, what happened, and what came after. He said OpenAI's "rolling out of information is not particularly impressive to me." He also said the office is still only gathering facts, and that what it finds will decide whether any action is "civil or something else."
California is not alone. Alabama leads a separate probe joined by more than a dozen states, and Florida's attorney general has sued OpenAI. The California Department of Justice is also asking anyone with information about this or similar incidents to report it at oag.ca.gov/report.
It is not yet clear what documents and answers the subpoena demands, when they are due, or which incidents beyond Hugging Face it covers. Bonta has said it is too early to say what action his office might take.