California Subpoenas OpenAI
California served OpenAI an investigative subpoena on 30 September 2026, its 1 October notice says. The inquiry concerns company and model cyber incidents and risks; the notice reports no new customer incident or finding.
California’s 24 September statement had already described an inquiry into July’s OpenAI-agent incident at Hugging Face and urged Congress to oversee frontier AI. It proposed oversight rather than enacting it.
What California has disclosed
The notice does not publish the subpoena, its itemised demands, a response deadline, a named violation or a liability decision.
Alabama’s 24 August announcement concerns a separate consumer-protection investigation into the Hugging Face incident. It asks whether OpenAI’s controls violated Alabama consumer-protection law. BlackTree covered that investigation and the underlying agent incident. Alabama described allegations, asked whether testing posed an ongoing risk to residents and joined a coalition request to halt comparable tests until they could be run responsibly. That request was not a court order or a rule for every AI laboratory. The office was still seeking documents and information.
Alabama also published its 17-page subpoena, issued and served on 20 August. It requests the incident timeline and records about people and systems involved, safety measures, earlier internal warnings, possible harm, other agent incidents and evaluation policies. These are Alabama’s demands, not California’s.
What agent teams can prepare
Evaluation teams should retain each run’s approval, tool and network permissions, monitoring, incident decisions and affected-party communications. Scattered records impede reconstruction. Evidence should establish the controls actually used, rather than a general safety principle. This is operational advice, not a state-prescribed workflow.
The California statement also proposes government access to records and public incident findings. Teams can prepare without treating that proposal as a current duty: identify the owner of an evaluation incident, retain the evidence needed to reconstruct decisions and decide how to notify an external operator whose systems may be affected.
Primary sources
- California Attorney General, subpoena notice, 1 October 2026
- California Attorney General, inquiry and policy statement, 24 September 2026
- Alabama Attorney General, investigation announcement, 24 August 2026
- Alabama Attorney General, subpoena 26-0007, issued 20 August 2026
This article provides operational context, not legal advice.
