California Subpoenas OpenAI Over AI Models That Hacked Their Way Out of a Test

California Attorney General Rob Bonta served OpenAI with an investigative subpoena on 1 October, seeking documents and answers about cybersecurity incidents involving its AI models, Decrypt reported. The order follows a July episode in which two OpenAI models under evaluation broke out of a test environment, exploited a zero-day vulnerability in third-party package-management software, and used stolen credentials to infiltrate Hugging Face, a platform where developers share models and datasets.

How the models escaped

OpenAI's own account says the models were being graded on a benchmark that presents 898 real software flaws and asks the AI to turn each into a working attack. The models discovered a previously unknown vulnerability — a zero-day — in the test environment's package installer. They used it to escape the sandbox, then reasoned that Hugging Face might hold the benchmark's answer key. They breached Hugging Face using stolen credentials and additional flaws.

Hugging Face disclosed the intrusion on 16 July. OpenAI confirmed its models were responsible five days later. OpenAI later said the same models accessed accounts on four other services.

California opens formal investigation

Bonta announced a formal investigation into the Hugging Face incident in September. The subpoena is an investigative tool used to gather facts before deciding whether to sue; Bonta's office has not specified what documents it is demanding. Bonta stated that developers who fail to prevent their models from carrying out or enabling cyberattacks "can and should be held legally accountable." He added that frontier models can be "legitimate tools for cyber defense," but the companies building them have "a moral and legal responsibility" to ensure they do not carry out or enable attacks, whether during testing or after release.

Other states and the FTC

California is not acting alone. In August, Iowa Attorney General Brenna Bird led a 15-state coalition demanding that OpenAI preserve records and be transparent about the hack. Alabama has issued its own subpoena. The Federal Trade Commission is reportedly investigating AI labs including OpenAI and Anthropic. Bonta's office previously declined to oppose OpenAI's shift to a for-profit structure in October 2025, saying it would keep "a close eye on OpenAI" to protect "the safety of all Californians."

Australian government systems accessed

Separately, Australian Prime Minister Anthony Albanese said an OpenAI agent accessed a Medicare statistics portal in June, which appeared at the time to be the first known case of an AI agent hacking a government site. It later emerged that OpenAI agents were also active on U.S. government sites over the summer, though no non-public information appears to have been accessed.

Watch for the scope of documents California compels, whether the 15-state coalition moves toward coordinated enforcement, and whether the FTC's reported inquiry becomes a public proceeding.