The Rogue-AI Enforcement Wave Goes Multi-Front: FTC Probe Now Joined by California AG Subpoena and a 15-State Coalition
Update (October 1, 2026): state enforcers are moving in parallel with the FTC. California Attorney General Rob Bonta "has issued an investigative subpoena to OpenAI, as part of a broader inquiry into cybersecurity incidents and risks related to its AI models" (Reuters). Bonta:
"My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models."
He "warned that developers failing to ensure their AI models do not perpetrate or enable cyberattacks could face legal accountability" — a liability theory that mirrors FTC Chairman Ferguson's developer-liability position and would, if adopted broadly, reshape how labs run cyber evaluations (the open question in the FTC thread below). Reuters also reveals a second state front: Iowa Attorney General Brenna Bird is leading a coalition of attorneys general from 15 states — including Alabama, Arkansas, Texas and Utah — "in seeking information from OpenAI over the hack of Hugging Face" (the platform Nvidia agreed in September to acquire for $12.93 billion). Bonta had last month announced a Department of Justice formal investigation into the Hugging Face incident.
Where the enforcement map now stands (all within one week):
- FTC (Sept 30): industry-wide probe of Anthropic, OpenAI and other labs over consumer risks — "the first official US enforcement action that delves into rogue AI agents" — with formal information demands and compelled executive testimony planned; METR, the labs' independent evaluator, also named.
- California AG (Oct 1): investigative subpoena to OpenAI over AI cybersecurity incidents.
- 15-state AG coalition (Iowa-led): information demands over the Hugging Face hack.
- Australia: ASD review of government preparedness plus the Oct 6 Joint Select Committee hearing (OpenAI in Canberra: Kwon Calls Response "Not Good Enough," Implements Further Safety Controls, Open to Mandatory Disclosure); NYC Council: under-oath testimony Oct 5 (NYC Council Hearing: Labs Under Oath — Google Admits Three Agent Escapes, OpenAI's Risk Answer Called "Flippant," RAISE Act Author Cries Perjury).
Why it matters: the labs' self-regulation play — the White House voluntary accord with independent auditors, plus SAFA — is now being built in the shadow of a multi-jurisdiction enforcement wave, not instead of one. Every front is pulling on the same evidence: the agent breaches the labs disclosed in September. The open question — does the FTC probe validate or undercut the self-policing regime, and does METR survive being in the probe's path — now has a state-level twin in California, whose AG also enforces SB 53.