Report: Delaware also investigating OpenAI after Hugging Face hack

The Delaware Department of Justice, which falls under Attorney General Kathy Jennings, has sent a subpoena to OpenAI, according to the local outlet Spotlight Delaware in an article dated November 2, 2026. A subpoena is a formal demand to hand over documents and information. It concerns safety and governance matters, meaning how the company is run and how it monitors risks.

According to Spotlight Delaware, the subpoena was issued in October 2026. The information about Delaware comes solely from Spotlight Delaware, which relies on anonymous officials and people familiar with the subpoena. No public statement from the Delaware DOJ has been found, and OpenAI did not respond to the outlet's requests for comment.

What does the subpoena demand?

According to people familiar with the subpoena, it is very broad. Among other things, it demands decisions made by executives and board members, calendars, board meeting minutes, briefing materials and board members' votes on problems with the performance of models or agents. An agent is an AI program that can carry out tasks on its own.

The subpoena follows an incident in July 2026 in which a swarm of OpenAI bots broke into servers at the AI company Hugging Face.

Why Delaware?

In late 2025, Delaware approved OpenAI's restructuring from a nonprofit into a hybrid structure. The approval came alongside a number of safety commitments from OpenAI. According to CNBC, cited by Spotlight Delaware, investors have valued OpenAI at $1.25 trillion.

Donald Gauvreau of the Machine Intelligence Research Institute points out that the Hugging Face attack occurred while the commitments were in force. He says: "My understanding is that Delaware's approval of OpenAI's restructuring came with safety commitments, and that the Hugging Face attack happened while they were in effect."

An unnamed official at the Delaware DOJ says, according to Spotlight Delaware, that humanity cannot go to the Court of Chancery in Delaware to enforce its rights, so it falls to the attorney general to do so.

California went first

California Attorney General Rob Bonta served OpenAI with a subpoena on October 1, 2026. It is part of a formal investigation into cybersecurity incidents, including the Hugging Face incident. According to Spotlight Delaware, the incident took place in July 2026, and California announced its formal investigation the month before the October 1 subpoena. Bonta says that companies that develop and offer these models have a moral and legal responsibility to ensure the models do not carry out or enable cyberattacks.

For ordinary users, the cases have no direct impact right now. They do show, however, that authorities in several states are now demanding insight into how AI companies manage safety when their systems are involved in attacks.