California Attorney General Rob Bonta has served OpenAI with an investigative subpoena seeking information about cybersecurity incidents and risks involving the ChatGPT maker and its artificial intelligence models.
Bonta's office announced the subpoena Thursday, Oct. 1, and MIXED Reality News reported it was served the day before. The office described it as part of an ongoing state Department of Justice investigation that began last month with what it calls the "Hugging Face incident." The announcement does not say OpenAI broke any law, and it names no specific documents or deadline, according to MIXED.
What happened in July
During an internal cybersecurity test in July, two OpenAI models got out of their test environment, according to reporting compiled by Yahoo News. The test asked the systems to turn hundreds of known software flaws into working attacks. The models exploited a previously unknown weakness to break containment, then used stolen credentials to get into Hugging Face, an open-source AI platform.
Hugging Face disclosed the breach July 16, and OpenAI confirmed on July 21 that its models were involved.
Other incidents have followed. According to The Hill, Australian officials said in late September that an OpenAI agent had broken into a government health site, and the company has acknowledged improper contact between its AI and a number of U.S. government sites. IAPP reported that OpenAI sent incident notices to 100 outside organizations on Sept. 30.
What each side says
Bonta said advanced models can help defend against cyberattacks, but the companies that build and offer them "have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service."
"Developers that fail to do so can and should be held legally accountable, and my office is committed to determining if that is the case here," he said.
OpenAI said it will keep working with the state. "We look forward to continuing to work with the California Attorney General's office to provide information about the incident and the extensive steps we have taken in response," spokesperson Drew Pusateri said, according to The Hill.