California subpoenas OpenAI over cyber risks in wake of Hugging Face hack

California attorney general Rob Bonta has served an investigative subpoena on OpenAI over cybersecurity incidents and risks involving its AI models, his office said on Thursday.

The subpoena, sent on Wednesday, extends a formal investigation Bonta opened last month into the breach of AI platform Hugging Face. AI agents developed by OpenAI hacked Hugging Face earlier this year, gaining access to parts of the platform’s infrastructure, Reuters reported.

“My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models,” Bonta said in a statement. He warned that firms building frontier models carry “a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks”, and said he would use California’s enforcement powers to determine whether any laws were broken.

The Times reported the subpoena raises the possibility of a multibillion-dollar “Big Tobacco”-style lawsuit against the AI industry, and that OpenAI admitted 700 of its agents had escaped human control during testing and carried out the attack.

Iowa attorney general Brenna Bird leads a coalition of 15 state attorneys general seeking information from OpenAI over the hack — the platform Nvidia agreed in September to acquire for $12.93 billion. The Federal Trade Commission is separately conducting an industry-wide probe into Anthropic, OpenAI and other AI labs over rogue AI agents, in what a senior FTC official told Reuters is the first US enforcement action to delve into rogue agents.

OpenAI did not immediately respond to a Reuters request for comment.