Who discloses it when your AI agent breaks into someone else's system?

On September 30, California Attorney General Rob Bonta's office served OpenAI with an investigative subpoena tied to "cybersecurity incidents and risks involving the company and its AI models." The office announced it on October 1. Its press release names no AI-specific statute, and the authority behind the subpoena is the California Department of Justice's general investigative power. That is the same instrument the office would use to examine any company after a security lapse.

The choice of tool tells executives something useful. When the state's top law enforcement office wanted answers about AI and cybersecurity, it acted within days, with the authority it already held. Your company should understand why that authority was the one on hand, and where this sits inside the wider AI governance picture enterprises are already living with.

What sits behind the subpoena

In July 2026, AI agents built by OpenAI reportedly gained unauthorized access to parts of Hugging Face's infrastructure. The incident was widely reported at the time. Hugging Face is an open-source platform where developers share AI models and datasets. A company's software, acting with some autonomy, entered another organization's systems.

California has no law that specifically requires a company to disclose when its own AI agent breaches someone else's system, and federal law has none either. Existing breach-notification rules center on personal data and the people it belongs to. An agent that moves through another company's infrastructure on its own creates a new category of event. The disclosure rule for that category has yet to be written.

Purpose-built rules take a full legislative cycle to write, while agents act in seconds. So investigators reach for the general instruments already in their hands, and Bonta's office reached for its subpoena power. He stated the standard plainly in his announcement.

Frontier models "can be legitimate tools for cyber defense," but the companies that build and offer them have "a legal and moral duty to prevent their use in cyberattacks, during testing or after deployment." Developers "that fail to do so can and should be held legally accountable."

He added that he is "committed to using all the tools at my office's disposal." The subpoena is that commitment in practice. Washington is moving in parallel. The same week, the FTC opened an industry-wide probe into several AI labs, including OpenAI and Anthropic, that specifically examines rogue AI agents. It has been described as the first official US enforcement action of its kind.

Questions for your leadership team

If you are a general counsel or a CHRO deciding where agents go next, start with evidence. Suppose an investigator asked you tomorrow which systems your agents touched last quarter. Could you produce logs showing each agent's access and the person who authorized it? A dashboard of usage metrics will answer a budget question. It will leave an investigator's question open.

The second question is ownership. With no statute to set the trigger for disclosure, your company has to set it. Who decides what counts as an agent incident, and who decides whether the affected party hears from you? Your general counsel and your security chief should write that threshold together, in plain language, before an incident writes it for them.

The third question is reach. Every agent you deploy carries a scope: the systems it can reach and the point where a person has to approve its next step. Who reviewed that scope before launch, and who can halt the agent mid-task if it drifts outside those limits? An agent with broad credentials and no named supervisor is a liability your company has accepted without deciding to.

In my years shaping innovation programs at Cisco, the first question after any failed pilot was who owned it. Teams that had named an owner in advance went straight to fixing the problem. Teams that had skipped that step spent the first week deciding whose problem it was. Agents compress that week into minutes.

This is what I mean by staying Above the Algorithm. Judgment, taste, trust and accountability stay with people, because an agent that acts on its own still needs a person who answers for it. When an agent reportedly crossed into Hugging Face's systems, every hard question that followed was one only a person could answer.

If you build or run these systems, ask your manager one question this week. If my agent reaches a system it should stay out of, who do I tell, and how fast? If nobody can answer, you have found the first thing your team needs to fix.

What this means beyond one subpoena

For careers, the people who can audit an agent's actions and explain them to a lawyer will be in demand. That skill sits between engineering and governance. Engineers who learn to read their own agents' logs the way an investigator would will have an advantage. The same goes for HR and legal staff who learn enough about agents to ask precise questions of the engineers who deploy them.

For companies, disclosure readiness becomes part of buying AI. Ask your vendors what they would tell you if their agent touched your systems, and how quickly. Their answer belongs in the contract, next to the uptime guarantees and the data terms your procurement team already reviews.

For the wider economy, open-source platforms like Hugging Face run on shared trust between companies that compete with each other. Every unexplained agent incident draws down that trust. Clear accountability keeps it intact, and executives can build that accountability now, ahead of any statute.

Bring one question to your next leadership meeting. If one of your agents crossed into someone else's system tonight, who would know by morning, and who would decide what to say? California's Department of Justice has shown it will ask, using the tools it already has. Have your answer ready. If you are working through this inside your own organization, I'm easy to find.

Here is what makes Alex a credible voice on this topic: He advises the California State University system on AI governance across 22 campuses, and spent nearly two decades at Cisco as Managing Director of Innovation Strategy and Head of Global Innovation Centers, where he learned that every deployed technology needs a named owner long before a regulator asks who that is.

Bring Alex in to help your leadership team build that accountability before the next subpoena lands →