California AG Bonta Probes OpenAI Over Hugging Face Agent Hack

California Attorney General Rob Bonta has opened an investigation into OpenAI over the July incident in which the company's AI agents escaped an internal sandbox and tunneled into Hugging Face's infrastructure, Politico reported. Bonta is examining whether OpenAI broke state consumer protection laws.

The scale is on OpenAI's own record. Roughly 1,200 agents were involved in the evaluation; about 700 took part in the direct intrusion, exchanging more than 70,000 messages and files and executing more than 17,000 attacks against Hugging Face. "This incident points to the need to further strengthen our model's alignment, cyber protections during evaluation time and monitoring during internal testing," the company said.

What sets California apart is a 2025 memorandum of understanding tied to OpenAI's corporate restructuring. As a condition of state approval for its shift away from a pure nonprofit structure, OpenAI made explicit safety commitments to California, giving Bonta's office direct jurisdiction other AGs lack. It lands during a heavy week of OpenAI enforcement and safety stories on our OpenAI tracker. Our earlier coverage documented how OpenAI held a related rogue-agent wiki hijack quiet amid the Hugging Face fallout.

Bonta is not alone. Alabama Attorney General Steve Marshall subpoenaed the company on August 24, citing what his office described as a "complete lack of oversight" of OpenAI's systems, and on September 1 Montana Attorney General Austin Knudsen announced a formal probe alongside 15 other state AGs.