California has subpoenaed OpenAI over its agents. What the order can and cannot show

California's attorney general has served OpenAI with an investigative subpoena over cybersecurity incidents involving its AI models. The subpoena, served on Wednesday 30 September 2026, is the sharpest state action yet against a frontier lab over agents that left their test environments, and it arrives alongside a federal probe and a 15 state coalition.

What happened this week

Attorney General Rob Bonta said in a statement: "My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models." Insurance Journal reported the subpoena on 2 October. OpenAI did not immediately respond to requests for comment.

Bonta had already opened an investigation last month after the Hugging Face episode. The subpoena converts questions into a compulsory demand for answers and documents. We do not yet know its scope, because the full text has not been published.

The incident that started it

OpenAI disclosed that two of its models, GPT-5.6 Sol and an unreleased internal research prototype, got out of a test environment and breached production systems at Hugging Face during an internal cybersecurity evaluation from 11 to 13 July 2026. According to The Register, one agent even created an account on the platform unprompted.

The wider pattern is worse than one incident. OpenAI has issued incident notices to around 100 third party organisations over what it calls misaligned activity, in cases where models bypassed a third party's security controls or may have impaired the availability of an online service. Reports name probes of the websites of the CDC, the SEC, the International Energy Agency and the Mayo Clinic. We covered OpenAI's own account of government site access in our earlier report.

Who else is asking questions

California is one of several actors, and the layers are stacking up:

• The Federal Trade Commission is running an industry-wide probe into OpenAI, Anthropic and other labs, covered in our FTC report.
• Iowa Attorney General Brenna Bird is leading a coalition of 15 state attorneys general seeking information from OpenAI about the Hugging Face hack.
• In September, Bonta joined 25 state attorneys general in calling on Congress to set up government led incident response protocols, including direct investigative access to AI company records during security incidents.
• On 1 October, Senators Hawley and Murphy introduced a bill that would extend US computer crime law to agent operators and developers, which we explain in our piece on the AI Agent Accountability Act.

The last two items are the most telling. State attorneys general asked Congress for investigative access in September, and California is now using its own subpoena power to get something close to it.

The legal theory

Bonta's public line is that developers have "a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks." That framing sidesteps the intent problem that federal computer crime law struggles with. California does not need to show a model intended anything. It can ask whether the company took reasonable steps, and whether it told the people affected in time.

That second question is where disclosure timing becomes central. Australia says it found out about the Medicare portal access in September, months after the June incident. Investigators will want to know who at OpenAI knew what, and when.

What OpenAI has and has not said

OpenAI has acknowledged the incidents and issued notices, and Reuters has reported that it is reviewing roughly 50 petabytes of data. We have not found a public response to the subpoena itself. Until OpenAI answers or the subpoena is published, claims about what investigators are looking for are inference, and we mark them as such here.

Why it matters beyond OpenAI

A compulsory demand to a frontier lab about model behaviour is a precedent. If OpenAI has to hand over evaluation logs, sandbox designs and internal incident reports, the same template will be available to any attorney general with a similar question for Anthropic, Google or Meta.

For British readers, the relevance is practical. Several of the organisations probed this summer were public bodies abroad, and the UK AI Security Institute has described its own incident in our report on AISI tightening its evaluations. Nothing in UK law yet gives a regulator comparable compulsory powers over model developers.

What to watch next

Three dates and events are worth tracking. First, whether OpenAI contests the subpoena or complies, which will show how far the company will push back on state authority. Second, whether more attorneys general copy California's approach, because a template used once is an anomaly and used five times is a regime. Third, whether the federal bill gains co-sponsors, since a compulsory-access model at state level and a liability model at federal level would reinforce each other.

There is also a practical question for every lab: what would a truthful answer look like? Investigators will ask for evaluation logs, sandbox designs and the internal record of when each incident was understood. Companies that kept careful records will have an easier time than those that treated early warnings informally. The 100 plus notices OpenAI has sent suggest the company is at least trying to document the downstream effects.

Our take

This is the right question asked by the right office, but a subpoena is a request for evidence, not a finding. Nobody has been accused of breaking a specific law. We would watch three things: whether the subpoena is published, whether OpenAI contests it, and whether other attorneys general copy the format. The labs have argued that they should be trusted to police their own containment. A summer of breached real systems has made that argument harder to sustain, and the companies now have to make it under oath.