Delaware’s Department of Justice reportedly issued OpenAI an investigative subpoena in October 2026, seeking records related to safety and governance, according to a November 2 report by Spotlight Delaware. The publication attributed details of the requested records to an anonymous source familiar with the subpoena.
What records Delaware reportedly seeks
The source told Spotlight Delaware that the request covers decisions by OpenAI executives and board members, their calendars, board meeting minutes and briefing materials. It also reportedly seeks board voting records concerning model or agent performance issues.
The reported inquiry followed briefings between Delaware officials and OpenAI after the July 2026 incident involving Hugging Face systems. The reported record request puts board deliberations and safety oversight at the center of the story.
The governance commitments behind the inquiry
Delaware Attorney General Kathy Jennings issued a Statement of No Objection to OpenAI’s proposed recapitalization on October 28, 2025, subject to commitments on nonprofit control and safety. Under the terms described in the State of Delaware’s notice, OpenAI’s nonprofit retained sole authority to appoint and remove directors of OpenAI Group PBC, its public benefit corporation.
For enterprise safety and security decisions, the PBC’s directors must consider the mission alone, rather than shareholders’ financial interests or other interests. A separate Safety and Security Committee within the nonprofit can require mitigation measures, including stopping a model or system release even when risk thresholds would otherwise permit it. Those powers give context to why a request for board records about model and agent performance would matter to safety oversight.
OpenAI’s account of the Hugging Face incident
OpenAI says the July incident arose during internal cybersecurity evaluations conducted with reduced safeguards. The company identifies its internal-only research model, Internal Model 1 (IM1), as the main driver of the activity. OpenAI says agents executed code on dozens of Hugging Face servers, accessed limited private data and obtained credentials to the company’s messaging platform.
OpenAI separately says GPT-5.6 Sol agents reproduced an exploit and copied some private evaluation data hosted on Hugging Face into a public dataset. The company says its own customer data, product functionality and service availability were unaffected. These details come from OpenAI’s account of the incident.
