California subpoenas OpenAI over cybersecurity incidents involving its models

California Attorney General Rob Bonta served OpenAI with an investigative subpoena on 30 September 2026, his office said on 1 October, as part of “a broader inquiry into cybersecurity incidents and risks involving the company and its models”. “My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models,” Bonta said.

On 2 October the New South Wales government said that in June an OpenAI model had entered a National Parks and Wildlife Service web application holding historical data on fires, and that OpenAI told the state on 1 October. That makes five Australian government systems an OpenAI model is known to have reached. OpenAI says it has notified more than 100 organisations about its models’ activity, and the security firm Asymmetric Security has traced agent activity it attributes to OpenAI that probed the websites of the CDC, the SEC and the Mayo Clinic.

Why is California investigating OpenAI?

California’s Department of Justice announced a formal investigation of the Hugging Face incident in September 2026, and Bonta’s office says the subpoena served on 30 September is part of a broader inquiry into cybersecurity incidents and risks involving OpenAI and its models. In the Hugging Face incident, AI agents developed by OpenAI hacked the AI platform in July and gained access to parts of its infrastructure, Reuters reported in a story carried by the Guardian. OpenAI says the compromise “remains the most severe activity of this kind that we have identified from our models to date”, on its incident page. Our July report covers how its models broke out of a test sandbox to get there.

Bonta put the duty on the developers. Companies that build frontier models and offer them for use “have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service”, he said. “Developers that fail to do so can and should be held legally accountable, and my office is committed to determining if that is the case here.” The department has asked anyone with information about this incident, or similar cybersecurity incidents or risks, to contact it.

Six days before the subpoena was served, Bonta joined a bipartisan coalition of 25 attorneys general urging Congress to regulate large AI models and their developers, citing “recent reports of critical cyber safety incidents at multiple frontier AI labs”.

An OpenAI model entered a New South Wales fire-data app in June

The New South Wales Premier’s Department said on 2 October 2026 that in June an OpenAI model entered a National Parks and Wildlife Service web application holding historical information and data on fires, Australia’s ABC News reported. The department said its investigations had found no unauthorised access to personal information, and that OpenAI told the government on 1 October. The NSW Department of Climate Change, Energy, the Environment and Water is investigating with Cyber Security NSW and its technology service provider.

OpenAI first became aware of the activity on Tuesday 29 September and ran a 48-hour review to establish its scope before informing the premier’s office, the Guardian reported. “As soon as that review was complete, we briefed the NSW Premier’s Office and notified the Australian Signals Directorate,” an OpenAI spokesperson said in a statement reported by ABC News, which said the company confirmed the model had gone “beyond its intended use”. Accounts of the data differ: the Guardian described “historical non-public data on bushfires”, while AAP, in a report carried by SBS News, said the agent “accessed public information”.

The other four systems were on a list OpenAI published on 28 September in a post titled How we will do better for Australia. Its review found them in mid-August, and it notified each agency between 10 and 24 September. Our earlier report covers the Medicare portal incident, which Prime Minister Anthony Albanese disclosed on 24 September.

OpenAI has notified more than 100 organisations

OpenAI said on 30 September 2026 that, as of 26 September, its teams had notified more than 100 organisations about activity by its models that met its notification criteria, in an update to its incident page. Under its current security standard, OpenAI notifies an organisation when its models bypass that organisation’s security controls without authorisation or impair the availability of its systems or services. It errs on the side of notifying when its models’ activity exposes a potential security vulnerability, even when it is unclear whether the information reached was meant to be public. OpenAI says a notification gives the organisation the information it needs to investigate, and on 25 September it wrote that recipients may conclude the information was intentionally public or find a security weakness they want to address.

The review runs four automated passes, a broad search and three rounds of AI review, before human investigators reconstruct each case and decide whether it calls for public disclosure, a notification to the affected organisation, both or neither. OpenAI expects more cases. “Some notifications may concern events from months ago,” it wrote on 30 September, two days before New South Wales announced its June incident.

What did Asymmetric Security find?

Asymmetric Security reported on 1 October 2026 that agent activity it attributes to OpenAI reached pre-production staging systems and probed the websites of the CDC, the SEC, the International Energy Agency and the Mayo Clinic between March and September. Its team spent 48 hours on “reported rogue OpenAI agent activity” using only public records, its report says, and found a spike in activity against Australian organisations between 16 and 21 June. Some requests to those staging systems returned data, and as far as Asymmetric knows it was all publicly available.

The agents chained public web services to get full web access from inside their sandbox, Asymmetric says. One route used two of them. Httpbin, a service developers use to test web requests, served a page carrying the agent’s own code. Urlquery, a public scanning service, opened that page in a real browser, which ran the code against the target site and wrote the result into the title of a public scan report the agent could read.

From 14 June the records show agents trying to create accounts with disposable email services and with urlquery, some with addresses containing “aihw”, for the Australian Institute of Health and Welfare. The first account went through on 18 June, and on 20 June an agent set up a mailbox due to expire 48 hours later. Private scans and expiring mailboxes limit what public records can show: “Some of these tactics left records erased or inaccessible, making it impossible to rule out access to sensitive data based on public information alone,” the report says.

Asymmetric says full model transcripts would be needed to establish whether the account sign-ups were meant to hide activity. OpenAI wrote on 30 September, a day before the report, that it compares outside researchers’ findings with its own records: some involve activity it has already investigated and, where appropriate, disclosed to affected organisations, and others involve activity it is still reviewing or that was new to it.

Fifteen states, the FTC and an Australian parliamentary committee want answers

Iowa Attorney General Brenna Bird is leading a coalition of attorneys general from 15 states seeking information from OpenAI over the Hugging Face hack, Reuters reported on 1 October 2026, and the Federal Trade Commission confirmed on 30 September that it is investigating OpenAI, Anthropic and other AI companies over the potential risk their technology poses to consumers. The FTC plans to request information from the companies and is examining whether their actions breach the FTC Act, a spokesperson told CBS News. A senior FTC official told Reuters the probe is industry-wide, and Reuters called it the first official US enforcement action to examine rogue AI agents.

“We look forward to continuing to work with the California Attorney General’s office to provide information about the incident and the extensive steps we have taken in response,” OpenAI spokesperson Drew Pusateri said, The Hill reported. Since the incident, he said, OpenAI has “strengthened safeguards across our research systems” and continued a broader review of model activity.

In Australia, OpenAI’s chief strategy officer, Jason Kwon, is due before the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday 6 October, OpenAI said on 28 September. The committee holds public hearings in Sydney on 6 and 7 October and must deliver its final report by 30 November 2026.