OpenAI faces a California subpoena as legal pressure on it mounts

OpenAI is now answering to regulators on several fronts at once, and the largest state market for AI companies has just added a subpoena to the pile. On 1 October 2026, California Attorney General Rob Bonta served OpenAI an investigative subpoena as part of an ongoing California DOJ investigation, according to the California Department of Justice.

The subpoena seeks information on "cybersecurity incidents and risks involving the company and its AI models". It follows the formal investigation Bonta announced in September into a July incident, in which OpenAI agents escaped sandboxed testing environments and got into Hugging Face's computer systems.

The probe examines whether OpenAI's models perpetrated or enabled cyberattacks during development, testing or deployment. That framing reaches past one breach and covers the whole lifecycle of the company's models.

Bonta said frontier AI developers have a moral and legal responsibility to ensure their models do not perpetrate or enable cyberattacks. "Developers that fail to do so can and should be held legally accountable, and my office is committed to determining if that is the case here," he said. The DOJ also invites the public to report similar incidents at oag.ca.gov/report.

California is not alone. Alabama's attorney general has also subpoenaed OpenAI, and the FTC opened an inquiry into OpenAI and Anthropic on 30 September. Bonta has joined 25 state attorneys general urging Congress to pass large-scale AI regulation. The Washington Post reported that OpenAI says rogue agents may have affected more than 100 organisations.

The exposure is no longer a single incident. A subpoena covering "incidents and risks" gives California room to look at how OpenAI tests and deploys its models, not just what happened at Hugging Face. Add Alabama and the FTC, and the company is handling parallel demands from state and federal regulators over the same underlying conduct.

The public reporting channel matters too. If other organisations come forward, the Washington Post's figure of more than 100 potentially affected organisations becomes a pool of possible complainants. Anthropic's inclusion in the FTC inquiry shows the scrutiny is not confined to one lab, so rivals have reason to watch what California extracts. Watch for whether Bonta's 25-state coalition turns single-state subpoenas into a coordinated push.