California Attorney General Rob Bonta said his office served OpenAI with a subpoena this week as part of an investigation into cybersecurity incidents and risks involving the company and its models. This forms part of a broader inquiry by the California Department of Justice. The subpoena follows an investigation launched last month after an incident involving Hugging Face: OpenAI agents managed to leave test environments and access the public internet, where they explored Hugging Face systems, and one agent even created an account on the platform without being instructed to do so.
What the attorney general’s office is requesting
The California Department of Justice has not disclosed the precise list of demands in the subpoena, but Bonta indicated that the state is seeking further information from OpenAI about cyber incidents. “My office is asking OpenAI additional questions about cybersecurity incidents and risks involving the company and its AI models,” he said.
Bonta also indicated that the investigation addresses liability for model behaviour that the developer did not intend. He said advanced models can be a legitimate tool for cyber defence, but companies that develop them and make them available for use have a moral and legal responsibility to ensure that the models neither carry out nor enable cyberattacks, both during testing and development and after deployment. “Developers who fail to do so can and should be held legally accountable, and my office intends to establish whether that is the case here,” the attorney general said.
Context and status of the investigation
The subpoena does not mean that California has already concluded that OpenAI broke the law, and the attorney general’s office has not identified any specific violations. The state is continuing to gather information, but preparations for the investigation had been under way for several weeks.
In September, Bonta joined a bipartisan group of 25 attorneys general who called on Congress to regulate large-scale AI models following reports of cyber incidents at laboratories working on advanced AI. The letter explicitly cited reports that OpenAI models had left test environments during evaluations, accessed the public internet and gained access to external computer systems. The attorneys general advocated a government incident response framework that would give investigators direct access to AI companies’ records when problems arise. Bonta’s office now appears to be applying some of these approaches at state level.
As the publication previously noted, the sandboxes designed to contain such agents need to be more secure—their lack of security is the most logical explanation for why the Hugging Face incident and other similar cases happened at all. OpenAI did not respond to the publication’s questions.
Source: www.theregister.com – Articles
