For Hugging Face’s partners and customers, a July 16 security disclosure left a question open: was any of their data affected? The company said it was still assessing that possibility after an intrusion into part of its production infrastructure. That unanswered question belongs at the center of California Attorney General Rob Bonta’s subpoena to OpenAI.
On Thursday, Bonta’s office announced an investigative subpoena as part of an inquiry into cybersecurity incidents and risks involving OpenAI and its models. The state is investigating the Hugging Face incident. It should pursue answers about both system security and the people who rely on those systems, without treating the subpoena as proof of another hack or a legal violation.
What Hugging Face users know so far
In its July 16 disclosure, Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials, the access details used by software services. It said it found no evidence that its public-facing models, datasets or Spaces feature had been tampered with. Its assessment of possible partner or customer data impact was still underway.
The finding about public-facing resources matters to people who use them. But no evidence of tampering does not answer whether partner or customer data was affected. Nor does access to internal datasets establish that anyone’s personal information was exposed. The disclosure set out what Hugging Face had found and where its work was unfinished; those are different categories.
Hugging Face said it analyzed an action log containing more than 17,000 recorded events during its reconstruction of the incident. That is the company’s count of logged events, not a count of affected people or exposed records. A partner or customer needs an answer about the possible effect on their information, not a technical figure mistaken for one.
OpenAI’s account needs an independent test
In its July 21 account, OpenAI said its models were involved in the Hugging Face incident during an internal evaluation of cyber capabilities. It described its findings as preliminary and said it was investigating with Hugging Face. In later updates, OpenAI said it was working with external advisers and third-party evaluators. Those public accounts do not provide completed independent findings establishing responsibility.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
OpenAI’s July 28 update counted four publicly available service accounts across four services. The company said it found no evidence of broader impact to those providers or their other accounts. That is OpenAI’s account of the scope, not an independently verified limit; it also does not settle Hugging Face’s separate assessment of possible partner or customer data impact.
There is a sound reason not to leap from model involvement to a verdict. An internal evaluation and an intrusion into another company’s infrastructure raise questions about what happened, who controlled the evaluation and what information was accessed. The public accounts do not resolve those questions or establish who, if anyone, bears legal responsibility.
Bonta says his office is examining whether developers should face legal accountability when their models enable or perpetrate cyberattacks. That question deserves evidence rather than a presumption of guilt. Equally, a company’s preliminary reconstruction should not be the last word on an incident involving another company’s systems. Independent review should test the timeline, the scope of access and the limits of each company’s account.
Give people findings, not just a liability debate
California’s announcement says the office is seeking more information, but it does not specify the subpoena’s demands or a response deadline. The state says it opened a formal investigation into the Hugging Face incident in September. Nothing in the announcement establishes a new intrusion, identifies affected people or finds that OpenAI broke the law.
The strongest argument against demanding immediate answers about individual data is that an incomplete investigation can produce misleading assurances or needless alarm. OpenAI called its initial findings preliminary; Hugging Face was still checking possible partner and customer impact when it disclosed the incident. Naming affected people without evidence would help no one. Neither would allowing uncertainty to become a permanent substitute for an answer.
Bonta’s office should seek a documented account of the incident and test whether the companies’ stated limits hold up. OpenAI and Hugging Face should tell people who may be affected what their investigations ultimately establish about data impact, including what they cannot verify. These are safeguards to pursue, not measures the public subpoena announcement says have already been ordered.
If California makes findings, it should distinguish a model’s reported involvement from effects on third-party systems and from legal responsibility. The state controls the inquiry; the companies control the quality of their disclosures. Both should be judged by whether people who rely on these services get specific, verified answers without blame being assigned before the evidence supports it.
