California Attorney General serves a subpoena on OpenAI over cybersecurity

California Attorney General Rob Bonta has served OpenAI with an investigative subpoena, a formal request for the company to answer additional questions about its cybersecurity incidents and risks.

His office served it on September 30 and announced it on October 1. It is part of the formal investigation into the Hugging Face incident announced in September (Hugging Face is the platform where open AI models are shared), and of a broader inquiry into cybersecurity incidents and risks involving the company and its models. The office does not detail what happened in that incident.

Bonta says frontier models can be legitimate tools for cyber defense, but that the companies that develop and offer them have a moral and legal responsibility to ensure they do not perpetrate or enable cyberattacks, both during testing and once they are in service, and that developers that fail to do so should be held legally accountable. His office wants to determine whether that is the case here. It is an investigation, not an accusation.

We believe the lesson for a small business that uses AI is the usual one. It makes sense to give each tool only the permissions it needs and to review what it does.