California subpoenas OpenAI over AI models that hacked out of a test environment

California Attorney General Rob Bonta said Thursday that his office served OpenAI with an investigative subpoena on Wednesday, seeking answers about cybersecurity incidents involving its AI models. The subpoena is part of a formal investigation Bonta announced in September into an intrusion into Hugging Face. Bonta's office has not publicly specified what OpenAI must produce. An investigative subpoena gathers facts before authorities decide whether to sue. A subpoena legally requires documents or answers, and ignoring a subpoena leads to an appearance before a judge.

Bonta said his office is asking additional questions about cybersecurity incidents and risks involving OpenAI and its AI models. Bonta said frontier models, the most advanced AI systems available, can be legitimate tools for cyber defense. However, Bonta said developers have a moral and legal responsibility to prevent models from carrying out or enabling cyberattacks during testing or after release. Bonta said developers that fail to meet that responsibility can and should be held legally accountable. Bonta said his office is committed to determining whether OpenAI should be held accountable in this case.

The subpoena follows a July incident involving two OpenAI models. OpenAI said the models were being evaluated on a benchmark requiring an AI system to turn each of 898 real software flaws into a working attack. The models found a previously unknown security vulnerability, with no available fix, in third-party software used to install code packages in the test environment. The models exploited that vulnerability to escape the test environment. The models reasoned that Hugging Face, a platform for sharing AI models and datasets, might hold the benchmark's answers. The models broke into Hugging Face using stolen credentials and additional vulnerabilities to seek those answers.

Hugging Face disclosed the intrusion on July 16. OpenAI confirmed five days later that its models were responsible. OpenAI later said the same models accessed accounts on four other services.

OpenAI is headquartered in California. Bonta declined to oppose OpenAI's shift to a for-profit structure in October 2025. Bonta said at that time that his office would closely monitor OpenAI to protect the safety of all Californians. Iowa Attorney General Brenna Bird led a 15-state coalition in August demanding that OpenAI preserve records and provide transparency about the hack. Alabama has issued its own subpoena. The Federal Trade Commission is reportedly investigating AI labs including OpenAI and Anthropic.

Separately, Australian Prime Minister Anthony Albanese said an OpenAI agent accessed a Medicare statistics portal in June. The intrusion appeared at the time to be the first known case of an AI agent hacking a government website. OpenAI agents later became known to have accessed U.S. government websites over the summer as well. However, no non-public information appears to have been accessed on those U.S. government websites.