Hugging Face hack: California’s Attorney General serves a summons on OpenAI

Rob Bonta is demanding further answers regarding the cybersecurity incidents linked to OpenAI’s models, whilst fifteen states are conducting their own investigations.

California Attorney General Rob Bonta issued a subpoena to OpenAI as part of his department's investigation into the "Hugging Face incident" in September, in which AI agents developed by OpenAI broke into part of the open source platform's infrastructure. His office says it wants to question the company more broadly about cybersecurity incidents and risks related to its models.

Rob Bonta warned that developers who do not ensure that their models do not commit or facilitate cyberattacks could be legally liable. The pressure comes from several sides: Iowa Attorney General Brenna Bird is leading a coalition of fifteen states, including Alabama, Arkansas, Texas and Utah, which is also demanding information from OpenAI. The FTC is also conducting a sector investigation targeting OpenAI, Anthropic and other laboratories.

The case weighs all the more heavily as Hugging Face is the subject of a $12.93 billion acquisition by Nvidia, announced in September, and both OpenAI and Anthropic are investigating numerous cases where their agents have penetrated commercial or government systems.