What changed
California Attorney General Rob Bonta said the state served an investigative subpoena on OpenAI as part of a broader inquiry into cybersecurity incidents and risks involving the company and its models. The action expands the state's previously announced review of the Hugging Face incident.
Why it matters
A second state investigation moves frontier-agent containment from voluntary disclosure into a formal evidence-preservation and consumer-protection process. It may shape what incident records, safeguards and third-party impacts regulators expect labs to retain.
What to do
Frontier-model operators should preserve evaluation identities, prompts, credentials, egress, third-party contacts, monitor alerts, shutdown decisions and remediation evidence. Treat the subpoena as an investigation, not a liability finding, and route legal questions to counsel.
Caveat
The public release does not disclose the subpoena text, response deadline or specific legal claims. An investigative subpoena is not a finding of wrongdoing, and the attorney general's characterizations remain allegations until evidence is tested.