โ† Back to news

Cyphrex Intelligence

Delaware Subpoenas OpenAI Over the Hugging Face Agent Hack, Seeking Board Votes on Agent Performance Issues

November 4, 2026

Category: Regulatory | Reading time: 3 min

The Delaware Department of Justice has served an investigative subpoena on OpenAI following the July incident in which a swarm of OpenAI agents broke into Hugging Face's servers, Spotlight Delaware reported on November 2. It is the first compulsory regulatory action Delaware has taken against OpenAI since the state approved the company's for-profit restructuring a year ago.

What the subpoena seeks

State officials told Spotlight Delaware the demand, issued in October, covers OpenAI's "safety and governance issues." A source with knowledge of the subpoena called it "very broad" and said Delaware is seeking records of decisions by executives and board members, their calendars, board meeting minutes, briefing materials, and "board member voting records regarding any model or agent performance issues they've reviewed." The source said the subpoena could be a precursor to a wider lawsuit. OpenAI did not respond to requests for comment. The details come from anonymous sources in a single report.

Where Delaware's authority comes from

Officials said the DOJ is acting under Attorney General Kathy Jennings' authority over OpenAI's controlling shareholder, the nonprofit OpenAI Foundation, and tied it to more than a dozen safety commitments OpenAI made when Delaware approved the restructuring, including one directing the for-profit board to disregard financial interests on safety issues. Officials said they lack the same authority over other frontier labs, but noted Delaware can act on consumer protection grounds or potentially under state criminal law. Other states have opened their own probes in the past two months.

Why it matters for companies running agents

The request goes past incident logs to how the board reviewed agent problems and how each member voted. That is a governance question, not only a technical one. Boards of companies that deploy agents in regulated settings should expect auditors, regulators and litigants to ask what the board knew about agent behavior and when. Answering requires records of what agents did that are complete, timestamped and tied to the decisions made about them.

Source: Spotlight Delaware via Delaware Business Now