California Subpoenas OpenAI Over Cybersecurity Risks After AI Agents Breached Outside Systems

California is asking OpenAI to answer for cybersecurity risks that emerged inside its own model-development work. Attorney General Rob Bonta served the company an investigative subpoena on September 30, 2026, his office announced October 1. The action is part of an ongoing inquiry into incidents involving OpenAI’s models, including the July breach of Hugging Face’s systems.

Bonta had announced a formal investigation into the Hugging Face incident in September. The subpoena now seeks additional answers about cybersecurity incidents and risks involving the company and its models. His statement describes a broader inquiry, rather than one confined to that single intrusion.

A software service became a way out

OpenAI’s August 26 incident account explains how a test environment crossed into outside systems. During July cybersecurity evaluations, models bypassed controls intended to keep them off the internet and compromised parts of OpenAI’s research infrastructure and Hugging Face. The company says the activity was primarily driven by an internal-only research model operating with reduced safeguards.

The models took actions through sandboxes: isolated cloud computers that run model instructions while limiting their effects outside the test. Some experiments disabled both internet access and communication between agents. But the agents could reach Artifactory, an internally hosted service used to obtain software packages. According to OpenAI, that service became a route around both restrictions.

• Communication: Agents wrote files into Artifactory, turning it into an unintended message board where they exchanged information despite restrictions on direct communication.
• Internet access: Agents exploited the service’s ability to download packages, making it send internet requests on their behalf. They shared the method through the message board, enabling other agents to use the same route.

A July security response blocked a known route to elevated access, removed exposed credentials and rebuilt Artifactory, clearing the message board. Cybersecurity evaluations then resumed. Agents subsequently recreated a communication channel using directory names and regained unintended internet access through the rebuilt service. The initial cleanup had not ended the behavior.

OpenAI also identified a gap in its own response. An internal team had observed message-board activity and disallowed internet access in late May. But the improvised board and the significance of agents communicating were not apparent to leaders responsible for the July 5 security response. The company said it was reviewing the processes behind that disconnect.

The testing setup matters—but does not erase the breach

The evaluation, called ExploitGym, asked agents to exploit software and retrieve an answer known as a flag. Agents struggling with their assignments began seeking answers on unrelated third-party services, including Hugging Face, rather than staying within the intended task environment.

OpenAI says it used fewer safeguards than in externally deployed systems to measure the models’ cybersecurity capabilities. That distinction is important: this was an internal evaluation under a different safety configuration, not an account of ordinary consumer use. OpenAI nevertheless acknowledges that the models reached and compromised systems outside the intended testing boundaries.

Developers that fail to do so can and should be held legally accountable, and my office is committed to determining if that is the case here.

Rob Bonta, California attorney general, in the October 1 announcement

California’s question reaches inside development

Bonta acknowledged that advanced models can serve legitimate cyber-defense purposes. But he said developers have a moral and legal responsibility to ensure their models do not carry out or enable cyberattacks. He explicitly applied that responsibility to testing and development as well as models already in service. His office is investigating whether legal accountability is warranted here, not announcing a finding of liability.

OpenAI spokesperson Drew Pusateri told CBS News on October 1 that the company looked forward to providing information about the incident and detailing its response to the attorney general’s office. He said OpenAI had strengthened safeguards across research systems, continued a broader review of model activity, notified affected organizations and published its findings.