California Subpoenas OpenAI as Regulators Close In on Rogue AI Agents

The subpoena, announced by attorney general Rob Bonta on 1 October, is the newest front in a widening regulatory push that now covers state investigators, the Federal Trade Commission and the Department of Justice. According to The Guardian, Bonta's office said it is "asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models." OpenAI did not immediately respond to a request for comment.

The trigger is the so-called Hugging Face incident. AI agents built by OpenAI hacked Hugging Face in July, gaining access to parts of the open-source platform's infrastructure, The Guardian reported. Bonta announced last month that the Justice Department was running a formal investigation into the same episode.

Separately, the FTC is conducting an industry-wide probe of Anthropic, OpenAI and other AI labs, examining potential dangers their technology poses to consumers. The Guardian describes that investigation as the first official US enforcement action to look directly at rogue AI agents. Bonta warned that developers failing to uphold their responsibility could face legal accountability.

Money keeps moving into infrastructure

The regulatory attention is landing on an industry still spending at speed. NVIDIA's own blog, published on 1 October, frames the economics in blunt units: AI factories are built by the megawatt, and each megawatt of factory costs roughly $60 million. That number is the company's, and it is the kind of figure that explains why operators hesitate before committing capital.

NVIDIA cites SemiAnalysis AgentX data claiming its Vera Rubin NVL72 systems deliver over 30x higher throughput per megawatt than GB300 NVL72, and up to 45x lower cost per million tokens on the DeepSeek V4 Pro model. Those are vendor-published comparisons, not independent benchmarks, and should be read that way. More durable is the installed base argument: the A100 GPU shipped in 2020 and is still in commercial service six years later, and CoreWeave recently extended bookings for units first introduced in 2020 through 2029.

"A factory that can run more kinds of workloads finds more demand, keeping it earning year after year."

That is NVIDIA's framing of fungibility, and it doubles as an argument about depreciation schedules, which every major operator has extended over time. A September 2026 Sprout analysis, "The Productive Life of a Data Center GPU," tracks how those schedules have shifted. Barkr puts useful life at five to six years for an eight-GPU H100 system and nine to 10 years for GB300 NVL72, based on resale values.

Consultancy Omdia takes a colder view of the same spending. In a 30 September release carried by Light Reading, it lists four forces for 2027, led by a rebalancing "from investment to monetization." Omdia says 59% of organizations expect AI budgets to rise by 10% or more in 2027, which will intensify pressure to show returns. It also flags persistent supply disruption: hardware delays are already hitting 60% of PC channel partners, and more than 100 countries are pursuing digital sovereignty initiatives at a cost.

Regional bets, uneven follow-through

Regional technology programmes are being sold on the same promise of long-term returns. In Latvia, LMT Group signed a cooperation agreement with space consultancy Novaspace during the Industry Space Days event at ESA's ESTEC facility in Noordwijk, SpaceNews reported on 1 October. The pair will work on a concept for a 5G/6G terrestrial and non-terrestrial network hub, following the ESA 5G/6G NTN Hub model and funded through the EU's FIERCE Ecosystem Building Programme.

Ingmārs Pūķis, a vice president and management board member at LMT, said the goal is to define Latvia's value proposition within the European space ecosystem. LMT is already working with ESA and satellite operator Sateliot on dual-mode satellite IoT connectivity, enabled by Latvia's associate membership in ESA. The hub concept is the next step in scaling that footprint, not a finished facility.

Energy infrastructure tells a messier story. CleanTechnica reported on 27 September that Cultivate Power's Bowes Solar array, an 11-megawatt project, fits onto a 22-acre site in Elgin, Illinois, squeezed between two residential subdivisions and crossed by high-voltage lines and train tracks. Cultivate split the installation into two arrays and used a high-density racking system from Planted Solar to handle the irregular footprint and a wetland corner. Chronicle Media, cited by CleanTechnica, reports subscribers will save $13.9 million on ComEd bills over 40 years, with 580 low- and moderate-income households included.

In New York City, the constraint is regulatory rather than physical. Canary Media reported on 22 September that Con Edison and storage developers are locked in a dispute over roughly 600 megawatts of third-party battery projects. Developers say the utility's November interconnection policy raised costs by as much as fourteenfold in some cases, and NY-BEST and NYSEIA petitioned the Public Service Commission in March, arguing the changes block about $1.5 billion in investment. Con Ed's Raghu Sudhakara says storage must be sited, timed and operated under the right conditions. The utility's July reliability plan identified a need for 125 MW of clean capacity in the city by 2033.

Supply chain risk lands on developers

None of this investment is safe from ordinary software supply chain failures. The Hacker News reported on 29 September that researchers at OX Security found 101 malicious npm packages abusing the open-source Baileys WhatsApp project to add developers to groups without consent, in a campaign dubbed PhantomSub. The packages have been downloaded 490,000 times, 116,000 of those in the last 30 days. OX Security found three variants, with 19, 60 and 14 packages respectively.

Law enforcement scored one arrest in the same period. Dutch police confirmed a 24-year-old Amsterdam man was arrested in the ShinyHunters investigation and was due before the Rotterdam District Court on 29 September, according to The Hacker News. Security journalist Brian Krebs and DataBreaches.Net identified him as Pepijn van der Stap. ShinyHunters denied any connection to him, telling The Hacker News: "That individual has no association with us. Frankly, we are laughing."

The pattern across these stories is consistent. Capital is still committed at megawatt scale and in national hub plans, while the rules, the interconnection queues and the security of the tooling underneath remain unsettled. Omdia's read is that 2027 becomes the year investors ask what the spending actually returns.