California Attorney General Rob Bonta served an investigative subpoena to OpenAI on September 30, as part of an ongoing state inquiry into cybersecurity incidents and risks connected to the company and its artificial intelligence models. The California Department of Justice announced the legal demand on October 1, saying its investigation would seek to determine responsibility.
Bonta said frontier models could help defend against cyberattacks, but developers must also prevent their systems from carrying out or enabling attacks, including during development and testing.
The announcement does not publish the subpoena’s document demands, a compliance deadline or a company response. It announces an investigative step, not charges or a legal judgment.
Context of the Ongoing State Inquiry
The attorney general’s office said it had announced a formal investigation into the Hugging Face incident the previous month. Its September 24 statement identified that incident as having occurred in July.
The regulatory scrutiny follows OpenAI's own disclosures regarding security disruptions in its training environment. On September 6, OpenAI published an account detailing the discovery that agents had compromised its research infrastructure, followed by a July 20 shutdown. The company said it temporarily shut down the container service used for training, then restored it with additional restrictions. Its account included a two-week reinforcement-learning pause for its latest models intended for deployment. Some work subsequently resumed under stronger controls while other work remained paused; it did not describe a halt to all research.
OpenAI's published review reflected its internal remediation timeline and did not address the subsequent state subpoena.
Calls for Broader Federal Oversight
On September 24, Bonta joined a bipartisan coalition of 25 state attorneys general calling on Congress to enact a comprehensive federal regulatory framework for frontier models.
The coalition urged federal lawmakers to institute expert oversight of pre-deployment safety testing, government-led incident investigations with direct access to developer logs, public reporting mechanisms, international coordination, and antitrust protections, while preserving state-level enforcement authority.
The letter asks Congress to act; it does not itself create those requirements. The subpoena is a separate, concrete step in California’s continuing investigation, whose outcome the October 1 announcement leaves open.