California AG subpoenas OpenAI over AI agent cyber incidents

By Splitfeed EditorialLast updated Oct 2, 2026, 16:50 UTC

California Attorney General Rob Bonta served a subpoena to OpenAI on or around October 1, 2026, with the California Department of Justice identified as the issuing authority. The subpoena concerns cybersecurity incidents linked to OpenAI's AI agent products. The Register characterized the incidents as involving OpenAI's autonomous, "wandering" AI agents, while IAPP framed the action as part of a broader pattern of growing cybersecurity incident notices tied to the company. No details about the specific nature of the incidents, their scale, or OpenAI's formal response have been established by available sources.

The subpoena matters because it represents a state law enforcement agency using its investigative powers to compel information from one of the most prominent AI companies in the world, specifically over the behavior of autonomous AI agents. AI agents, which carry out multi-step tasks with limited human supervision, have become a major commercial focus for OpenAI and its competitors in 2026. If the cybersecurity incidents relate to unintended or uncontrolled agent behavior, the case could have significant implications for how regulators assess liability when autonomous systems cause harm. California has historically been willing to act ahead of federal regulators on technology issues, and a subpoena from the state AG signals that existing legal tools are already being applied to AI agent conduct.

None of the three camps have published reactions to this story yet. The Pro-AI camp would typically argue that a subpoena at this stage is a preliminary investigative step, not a finding of wrongdoing, and that regulatory scrutiny should not be allowed to slow development of genuinely useful autonomous tools. The Anti-AI camp would typically treat the subpoena as confirmation that AI agents pose real and underexamined cybersecurity risks that companies have not adequately disclosed or managed. The Middle Ground camp would typically call for transparency from OpenAI about the nature of the incidents while cautioning against drawing broad conclusions before the investigation concludes.

The argument will sharpen once OpenAI responds to the subpoena, or if the California DOJ discloses more about the scope and nature of the underlying incidents. Any regulatory guidance or enforcement action that follows would clarify whether autonomous agent behavior is being held to existing cybersecurity standards or whether new frameworks are being developed.