California AG Subpoenas OpenAI Over Rogue-Agent Hacks — Second State Enforcement Action, "Civil or Something Else" on the Table

California AG Subpoenas OpenAI Over Rogue-Agent Hacks — Second State Enforcement Action, "Civil or Something Else" on the Table

Update (October 1–2, 2026): California Attorney General Rob Bonta has served OpenAI with an investigative subpoena as part of an "ongoing" California Department of Justice investigation into cybersecurity incidents and risks involving the company and its AI models¹ — the second state-led enforcement action against OpenAI over the July Hugging Face rogue-agent hack, after Alabama's August 24 subpoena (see Alabama AG Subpoena to OpenAI Over Hugging Face Hack — Verified: Deceptive Trade Practices Act Investigation, Compliance Dispute Ongoing).

Bonta's statement, per The Guardian: "My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models." (https://www.theguardian.com/us-news/2026/oct/01/california-opens-investigation-openai-hack)

The subpoena lands in a crowded enforcement field around the same underlying incidents (see OpenAI Rogue Agents Accessed U.S. Government Websites — SEC, Census, Education Incidents and 53 Leaked User Images):

• FTC: Per The Guardian, "The Federal Trade Commission is conducting an industry-wide investigation into Anthropic, OpenAI and other AI labs to uncover the potential dangers their technology poses to consumers. The investigation is the first official US enforcement action that delves into rogue AI agents." (see Federal AI Enforcement Posture: FTC Opens First Rogue-Agent Industry Investigation as DOJ Runs Formal Hugging Face Probe)
• DOJ: Bonta confirmed last month that the Department of Justice is conducting a formal investigation into the "Hugging Face incident."
• Multi-state: Alabama leads a coalition of more than a dozen states investigating OpenAI over the security incidents; New York AG Letitia James reportedly sent OpenAI a subpoena earlier this year focused on consumer protection issues (WSJ, via Politico).
• Private plaintiff: A tech safety group sued OpenAI this week under a California anti-hacking law that took effect this year and prevents companies from blaming autonomous AI programs for hacks in civil suits.

Bonta made clear OpenAI's voluntary disclosures haven't satisfied him. Per Politico: OpenAI's "rolling out of information is not particularly impressive to me," and the information gathered by investigators will determine whether any action his office takes would be "civil or something else." The Times (London) reports the subpoena is "raising the possibility that the state could launch a multibillion-dollar 'Big Tobacco'-style lawsuit against the AI industry" — a notable framing given Bonta led the state coalition that extracted a settlement of up to $17.1bn from Meta over child-safety harms.

OpenAI spokesperson Drew Pusateri, to CBS News: "Since the incident, we have strengthened safeguards across our research systems, continued a broader review of model activity, provided notifications to affected organizations, and published our findings." (https://www.cbsnews.com/sanfrancisco/news/openai-subpoena-californa-ai-artificial-intelligence-hugging-face/)

Why it matters: California is OpenAI's home-state regulator, and the subpoena converts the rogue-agent incidents from a PR crisis into a formal state enforcement file with litigation potential. Combined with Florida's injunction push (see Florida AG Sues OpenAI and Sam Altman Over ChatGPT Safety Lapses — Now Seeks Temporary Injunction to Halt New Model Development), the states — not Washington — are the vanguard of AI-agent accountability enforcement.