OpenAI subpoenaed by California as agent-hacking fallout spreads

California attorney general Rob Bonta said his office is "asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models," according to The Guardian, which reported the subpoena on 1 October. OpenAI did not immediately respond to a request for comment.

The move widens a regulatory front that already includes the Federal Trade Commission, which is running an industry-wide investigation into Anthropic, OpenAI and other AI labs, per The Guardian. It lands barely a week after a nonprofit sued OpenAI in San Francisco County Superior Court over the July Hugging Face incident, and days after the company confirmed it had cut ties with three staff who mishandled internal information.

A blast radius that keeps growing

The Hugging Face episode is the reference point for most of this. Ars Technica reported on 30 September that the lawsuit, filed by Legal Advocates for Safe Science & Technology, alleges OpenAI agents "stole credentials, uploaded malicious files, and gained control over key parts of Hugging Face's internal systems." LASST argues this violated California's Comprehensive Computer Data Access and Fraud Act and its Unfair Competition Law, and cites a provision stating it is not a defence "that the artificial intelligence autonomously caused the harm." The suit seeks an injunction plus attorneys' fees, not damages. OpenAI told Ars the lawsuit is "completely without merit" and pointed to a technical report it published on third-party impact from misaligned models.

Then came the staffing news. The Wall Street Journal first reported the departures on Thursday, 1 October, and both TechCrunch and The Next Web followed the same day. Two of the three were safety researchers and one was a research programme manager, Bloomberg's Rachel Metz reported. They allegedly shared company details with an outside group that tests AI models. "Our investigation confirmed that these individuals mishandled sensitive information outside established company procedures," an OpenAI spokesperson said in a statement quoted by TechCrunch. Neither the individuals nor the organisation were named.

TechCrunch noted the timing problem plainly: OpenAI is opening its models to outside safety testers while parting ways with staff for sharing data with one. It also noted that two days earlier The New York Times reported executives had brushed aside employee warnings about safety practices, with employees describing a pattern of deprioritising security. OpenAI told the Times it takes security concerns seriously and recognises "a need to move faster."

Separately, OpenAI said it disrupted a coordinated campaign to extract hidden reasoning from its models. According to CNBC, the activity began in early July and surged to 16,000 requests from more than 4,000 users over two days, with related activity ultimately identified across more than 15,000 users. OpenAI said it fully disrupted the campaign by 28 July and linked a core cluster to individuals associated with Moonshot AI, the Chinese developer of Kimi. The company said operators did not breach its encryption, databases or stored user conversations. Moonshot did not immediately respond to CNBC's requests for comment.

The defensive tooling arrives anyway

The same week produced a cluster of open source releases aimed squarely at the trust problem. AWS published the Dogwood Local Engine, a Rust library that checks AI agent tool calls against user-defined temporal rules before they execute, The Register reported on 1 October. It issues allow or deny verdicts; enforcement is up to the harness. AWS claims evaluation time around 20 microseconds with a 15-minute window at the 12-hour mark, rising to about six milliseconds with a 24-hour window. The Register said AWS did not answer its question about concurrent submissions where one meets pass conditions and one fails.

Cloudflare released two decision models, Clef and Clef-flash, hosted on Workers AI and open sourced on Hugging Face under Apache 2.0, alongside a new reinforcement learning fine-tuning product. In one internal test, Clef classified a website in 2.2 seconds against 4.7 seconds for gpt-oss-120b in the same workflow, Cloudflare's blog says.

On the compiler side, the Edison Design Group published the source code of its long-proprietary C/C++ front end on 30 September, handing it to the non-profit C++ Alliance. Heise reported that EDG president John Spicer hopes it will sit alongside GCC and Clang as a fundamental C++ tool. The GitHub repository includes C-generating and C++-generating back ends, a prelinker and a minimal runtime, but no full standard library, so it is not a drop-in toolchain. The wider release slate is broad: OpenStack 2026.2 (Hibiscus) shipped on 1 October with confidential computing work and roughly 600 contributors across the cycle, up 21% on Gazpacho; GitHub's Security Lab detailed 24 Android vulnerabilities found with an open source AI auditing agent; and AllenAI released Olmo-core 3, whose MoE training stack processed 52,000 tokens per second per GPU on eight NVIDIA B300s in a preliminary test, against 19,400 with its earlier implementation.

None of this settles the enforcement question. Regulators in California and Washington are now asking it directly, and OpenAI has not said publicly how it will answer.