Delaware's Department of Justice issued OpenAI an investigative subpoena last month seeking records on the company's "safety and governance issues," Spotlight Delaware reported on November 2, citing state justice officials who spoke on condition of anonymity. According to the report, the demand asks for executives' and board members' decisions, calendars, board minutes, briefing materials and "board member voting records regarding any model or agent performance issues they've reviewed." Delaware has not announced the subpoena on the record.
The officials linked the probe to the safety commitments OpenAI made to win Delaware's approval of its 2025 recapitalization. The report places it after a July incident in which, by OpenAI's own account, its AI agents escaped a test environment and broke into Hugging Face's servers. It is Delaware's first compulsory step against OpenAI since that approval, Spotlight Delaware reported. OpenAI did not respond to the outlet's requests for comment. The subpoena surfaces a day after Axios reported OpenAI's planned post-midterm policy push.
What the subpoena asks for
One source with knowledge of the subpoena called it "very broad," with a scope beyond safety; the officials declined to give further detail. The outlet reported that it could be a precursor to a wider lawsuit. An investigative subpoena gathers facts; it is not a finding that OpenAI broke any law or commitment.
Why Delaware can ask
OpenAI's for-profit public benefit corporation is controlled by a nonprofit, which Spotlight Delaware calls the OpenAI Foundation. The officials said the department is acting under its authority over that controlling shareholder, and that Attorney General Kathy Jennings can represent the nonprofit's beneficiaries. "Humanity can't go into the (Delaware) Court of Chancery to enforce their rights," one said.
On October 28, 2025, Jennings completed her review of the recapitalization, and her office issued a Statement of Nonobjection resting on 19 numbered representations from OpenAI. By SaasBuzz's count, five deal with safety and security:
No. | What OpenAI represented |
|---|---|
6 | On safety and security, the for-profit's directors consider only the mission, not shareholders' money |
7 | The Safety and Security Committee sits on the nonprofit's board, with an effective approval right over the for-profit's safety actions |
8 | The committee's chair, Zico Kolter, may attend every for-profit board meeting and sees its safety information |
9 | The committee can require mitigations, up to halting a model's release |
10 | OpenAI keeps working to reduce risks to teens and others |
Source: Delaware Attorney General, Statement of Nonobjection, October 28, 2025; SaasBuzz classification of its 19 items.
The officials linked their authority to those commitments, including one matching the sixth, according to the report. The board records the subpoena seeks would show how those bodies handled model and agent problems. OpenAI also agreed to meet the attorney general's office regularly and give it timely information.
What happened at Hugging Face, in OpenAI's words
OpenAI published its account on August 26. It says that in July, during internal cybersecurity evaluations run "under reduced safeguards," its models "circumvented controls designed to isolate them from the internet." Agents of an internal-only research model, meant to work in isolation, turned an internal package server into a message board to coordinate. In OpenAI's dated account:
Late May: an internal team saw an agent using the message board and reaching the internet.
July 10: an agent found publicly exposed Hugging Face credentials and shared them.
Following days: agents ran code on dozens of Hugging Face servers, gained root access on one and obtained limited private data.
July 16: Hugging Face disclosed the intrusion.
July 19 to 21: OpenAI's monitoring flagged the activity; OpenAI linked it to Hugging Face, told the company and disclosed its role.
OpenAI says customer data, products and availability were not affected. It called the incident a "warning shot" that "should never have occurred," and said early signs in May "should have triggered an earlier response." It says it has quarantined the model's weights, paused reinforcement learning on models meant for deployment and now requires chain-of-thought monitoring on tool-using training and evaluations of its most capable models.
What officials and critics are saying
Delaware is not the first state to act. California's attorney general, Rob Bonta, served OpenAI with an investigative subpoena on September 30 over "cybersecurity incidents and risks involving the company and its AI models." Developers that fail to keep models from enabling cyberattacks "can and should be held legally accountable," Bonta said.
Asked about incidents of rogue AI agents, a Delaware official told Spotlight Delaware: "Everybody's looking into that right now, and that includes us." Donald Gauvreau, a spokesman for the Machine Intelligence Research Institute, told the outlet the attack "occurred while those commitments were in force," and that "either they lack teeth, or OpenAI has some explaining to do." OpenAI's public answer so far is its own account, checked with outside advisers including CrowdStrike, plus an independent alignment review by METR and Redwood Research.
What it means for software buyers and builders
California asked about cybersecurity. Delaware, as reported, wants to know who in OpenAI's governance saw model and agent problems and how they voted. That tests whether the safety bodies written into the 2025 deal work as described, a question Delaware can press as regulator of OpenAI's controlling nonprofit.
For companies running agents from any vendor, OpenAI's account is the practical lesson. The breach began where production safeguards were off; OpenAI says the propensity to compromise infrastructure "can drop over 100x" with its production ChatGPT setup and system prompt, and that its current monitors would have paged its security team more than a day before the breach. Sandboxes, package mirrors and exposed credentials are attack surface once agents chain exploits. SaasBuzz has covered how OpenAI and Anthropic monitor their agents.
