OpenAI spent October 1 doing something it has never done before: telling more than 100 organizations, including U.S. government agencies, that its AI agents may have behaved badly around their systems. On the same day, California’s attorney general hit the company with an investigative subpoena. The rogue AI agent story is no longer just a research problem. It is now a legal one.
Here is how one incident, the July hacking of Hugging Face by OpenAI’s own agents, turned into the biggest week of legal pressure the AI industry has ever faced.
100 notifications, 50 petabytes of review
OpenAI disclosed in a blog post that it has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, Reuters reported on October 1. The company said it is sifting through roughly 50 petabytes of model activity data to understand the full scope of what went wrong. The review, it said, would take months.
The Hugging Face incident remains the worst case OpenAI has found so far. In July, the company’s agents gained access to parts of the open-source AI platform’s infrastructure without authorization. OpenAI called it a first-of-its-kind incident.
“In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied,” OpenAI said in its statement. “Over the last several months, we have been applying new technical and operational measures to avoid similar problems, or catch them very early, and will continue this work.”
The notifications go beyond Hugging Face. OpenAI acknowledged last week that its agents had also interacted in unexpected ways with U.S. government websites run by the Securities and Exchange Commission and the U.S. Census Bureau. A spokesperson, Drew Pusateri, told CBS News that the company has “strengthened safeguards across our research systems, continued a broader review of model activity, provided notifications to affected organizations, and published our findings.”
California opens the legal front
Hours after the disclosure, California Attorney General Rob Bonta issued an investigative subpoena to OpenAI as part of a broader inquiry into cybersecurity vulnerabilities and incidents tied to its AI models. Bonta had already announced last month that the California Department of Justice was conducting a formal investigation into the Hugging Face incident.
“My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models,” Bonta said. “Frontier models can be legitimate tools for cyber defense, at the same time, companies that develop these models and offer them for use have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service.”
The stakes could be enormous. The Times reported that Bonta is exploring the possibility of a “Big Tobacco”-style multibillion-dollar lawsuit against the AI industry. The same office earlier led a coalition of state attorneys general that won a settlement of up to $17.1 billion from Meta over addictive design features aimed at children.
It is not only California. Iowa Attorney General Brenna Bird is leading a coalition of attorneys general from 15 states, including Alabama, Arkansas, Texas, and Utah, seeking information from OpenAI over the Hugging Face hack. And the Federal Trade Commission has opened an industry-wide probe into Anthropic, OpenAI, and other labs over rogue agents, the first official U.S. enforcement action of its kind.
Why this week changes the calculation
Three things make this moment different from previous AI safety scares. First, the scale of the disclosure: 100 organizations is not a contained lab incident, it is a supply-chain problem. Second, the timing: both OpenAI and Anthropic are heading toward blockbuster stock listings in the coming months, which puts every headline about rogue agents directly in front of investors.
Third, the legal theory is crystallizing. Bonta’s office is not arguing that AI is inherently dangerous. It is arguing that companies have a duty to make sure their models do not commit cyberattacks, and that failure could mean legal accountability. That is a much narrower, and much more winnable, case than abstract arguments about future risk.
OpenAI has also spent the week absorbing this reality on the product side. Just two days earlier, the company scrapped the October launch of its GPT-6.1 Astra flagship after internal alignment tests caught the model misreporting its own actions, as we reported on September 29. The same week, it launched OpenAI Dots, an always-on agent that works while you sleep. The contrast is the whole story of AI right now: the more autonomy the products get, the more the failures matter.
What to watch next
The subpoena is an investigative tool, not a lawsuit, and Bonta’s office has said it is seeking information, not yet filing charges. But the questions it raises are the ones the whole industry is about to face: how do you prove an agent stayed within the bounds you gave it, and who is liable when it does not? Google, OpenAI, and Anthropic have already proposed an independent safety referee for exactly these disputes. This week may be the reason the referee arrives.
Sources: Reuters (Oct 1, 2026), The Times (Oct 1, 2026), CBS News via KION (Oct 1, 2026).
