AI Enforcement & Litigation Digest
TL;DR
The states have taken the lead: California subpoenaed OpenAI, Florida asked a court to pause frontier model development itself, and the FTC opened the first industry-wide rogue-agent investigation. The October 5 NYC hearing put lab executives under oath for the first time, and Maryland and Connecticut's surveillance-pricing bans went live without a first enforcement action yet.
The states are now the vanguard on rogue agents
California's home-state regulator has converted the Hugging Face saga into a formal enforcement file. Attorney General Rob Bonta served OpenAI an investigative subpoena as part of an "ongoing" California DOJ investigation into "cybersecurity incidents and risks involving the company and its AI models" — the second state subpoena after Alabama's in August (california-ag-openai-subpoena+1). Bonta was blunt that OpenAI's voluntary disclosures haven't satisfied him: OpenAI's "rolling out of information is not particularly impressive to me," and what investigators find will determine whether any action would be "civil or something else" (california-ag-openai-subpoena
+1).
"My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models." — california-ag-openai-subpoena
+1 (from The Guardian)
The Times (London) reports the subpoena is "raising the possibility that the state could launch a multibillion-dollar 'Big Tobacco'-style lawsuit against the AI industry" — a framing with teeth, given Bonta led the coalition that extracted a settlement of up to $17.1bn from Meta (california-ag-openai-subpoena+1). A tech safety group also sued OpenAI this week under a new California anti-hacking law that prevents companies from blaming autonomous AI programs for hacks in civil suits (california-ag-openai-subpoena
+1). The enforcement field around the same incidents now includes Alabama's coalition of more than a dozen states and a reported New York AG consumer-protection subpoena.
What to watch: Whether Bonta's "civil or something else" resolves toward a Big Tobacco-style suit — that choice would define the ceiling of state-AG exposure for frontier labs.
Florida's injunction ask is the most radical move yet
Florida has escalated from suing OpenAI to asking a court to stop development. On September 28, Attorney General James Uthmeier filed a motion for a temporary injunction in Highlands County circuit court that would prevent OpenAI "from advancing new AI models without third-party approved protections, and cut off minors from using its popular chatbot" (florida-ag-sues-openai-altman).
"The Court must stop [OpenAI and Altman] from recklessly advancing these systems while this case progresses." — florida-ag-sues-openai-altman
(from Politico)
The motion invokes a public nuisance theory, cites the Joshi v. OpenAI complaint, and leans on the newly disclosed government-website breaches as fresh grounds (florida-ag-sues-openai-altman). Uthmeier also taunted the labs with their own rhetoric: "If Sam Altman meant what he said about slowing down, he can join our ask to the court." A court granting even part of this — a state-imposed pause on new releases — would be the most intrusive judicial restraint on AI development anywhere in the U.S. to date.
What to watch: The ruling on the temporary injunction; even a partial grant rewrites the risk calculus for every lab shipping models into Florida.
The FTC's industry-wide rogue-agent investigation arrives
The federal posture has hardened from rhetoric to docket. Per The Guardian: "The Federal Trade Commission is conducting an industry-wide investigation into Anthropic, OpenAI and other AI labs to uncover the potential dangers their technology poses to consumers. The investigation is the first official US enforcement action that delves into rogue AI agents" (doj-ftc-ai-enforcement-posture). DOJ, meanwhile, is running a formal investigation into the "Hugging Face incident" itself — a marked shift from its earlier public stance ruling out "regulation by prosecution" of AI (doj-ftc-ai-enforcement-posture
).
An industry-wide sweep is the classic precursor to FTC Section 5 findings, and notably it targets the labs collectively rather than any single product's claims. The pattern is asymmetric federalism: DOJ disclaims prosecuting AI while quietly probing the first rogue-agent incident, the FTC builds an industry theory, and the states file the first actual instruments.
What to watch: Which forum moves first on rogue agents — that template will bind the others.
NYC extracts the first under-oath testimony — and subpoenas SpaceXAI
The October 5 Committee of the Whole hearing delivered what no legislature had: "the first public testimony under oath from major AI firms — including Anthropic, OpenAI, Google, and Meta" (state-local-frontier-ai-oversight). The subpoena mechanics were telling: only Meta responded to Speaker Julie Menin's letters; Anthropic confirmed "just hours before the subpoena was due to be served"; and SpaceXAI never responded and was actually subpoenaed on September 28, with judicial enforcement in New York State Supreme Court possible if it fails to comply (state-local-frontier-ai-oversight
).
"Leading experts and AI executives themselves are warning about the potentially grave risks of rapidly advancing AI, and governments have a responsibility to act." — state-local-frontier-ai-oversight
(from NY Council press release)
Former Anthropic researcher Jacob Coxon testified alongside the labs, and the hearing took up the ten-bill package including a first-in-the-nation whistleblower bounty and a private right of action for New Yorkers harmed by AI agents (state-local-frontier-ai-oversight). Whatever was said under oath is now discoverable in pending private litigation and usable by state AGs.
What to watch: Whether the private-right-of-action and whistleblower-bounty bills survive committee — together they'd give NYC a private enforcement ecosystem no state has.
Surveillance pricing bans are live, but the boundary is still undefined
Maryland's HB 895 and Connecticut's SB 4 both took effect October 1, making Maryland the first state with a hard ban in force: "As of Thursday, grocery stores and delivery services in the state are prohibited from using surveillance data to tweak the price of items from shopper to shopper" (surveillance-pricing-regulatory-wave). Maryland's penalties run $10,000 for a first offense and $25,000 for subsequent violations, AG-only enforcement, no private right of action (surveillance-pricing-regulatory-wave
). As of October 5, neither state has announced a C&D, suit, or settlement — the precedent-setting first interpretation of the surveillance-pricing/dynamic-pricing boundary remains open (surveillance-pricing-regulatory-wave
).
What to watch: Maryland's first enforcement action — Connecticut and New Jersey enforcers are expected to follow its reading.
What surprised us
- A court pausing model development is actually on the table. Florida's injunction motion isn't a fine or a disclosure order — it's a state asking to halt frontier releases (florida-ag-sues-openai-altman
- Three of four labs only testified under subpoena threat. Anthropic folded hours before service, OpenAI and Google under the same pressure, and SpaceXAI got served anyway (state-local-frontier-ai-oversight
- The EU fine rumors circulating on social media appear unverified. Claims of first AI Act fines "totaling €47 million" don't match the credible record, which shows the AI Office has only sent its first RFIs — treat any "first EU fine" claim with suspicion until the Commission confirms it.
- Maryland's cure period did its job quietly. The bans took effect with no scramble of emergency litigation and no first enforcement action yet (surveillance-pricing-regulatory-wave
) — compliance-first, contest-later is working as designed.