--- title: "In OpenAI’s memorandum with California, stopping a release isn’t OpenAI’s call" description: "On October 27, 2025, California granted a committee of OpenAI’s nonprofit board an approval right that can block a release by the operating company even past its own stated risk thresholds; after the July 2026 Hugging Face incident, fifteen other states are investigating under consumer-protection law, without that right written into any document of their own." url: https://csidia.com/en/notes/openai-california-chi-puo-fermare-un-rilascio/ lang: en date: 2026-09-03 label: "Observatory" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/openai-california-chi-puo-fermare-un-rilascio/ --- # In OpenAI’s memorandum with California, stopping a release isn’t OpenAI’s call On **October 27, 2025**, California Attorney General Rob Bonta signs a memorandum of understanding with OpenAI, Inc. that conditions the green light for the company’s corporate restructuring on a series of commitments. One of them, in paragraph 9, establishes that a committee of the nonprofit foundation’s board — not of the operating company that builds and sells the models — will hold “an effective approval right […] over PBC actions relating to safety and security.” Not an opinion, not a recommendation: a right that can block a decision made by a company it does not run. On September 3, 2026, while attorneys general in fifteen other states investigate OpenAI over a security incident from July, that specific right appears in none of their filings: it is written into one document, not the other. ## An approval right, not an opinion The memorandum — published by Bonta’s office, signed for OpenAI by deputy general counsel Renny Hwang — describes a precise structure. OpenAI, Inc. remains the “NFP,” the nonprofit foundation; the new for-profit entity, the “PBC,” is controlled by the NFP through a special class of stock, Class N, that gives it the sole power to appoint and remove PBC directors. That class of stock, and the exclusive right to wield it, is what turns the nonprofit’s board into the operating company’s ultimate principal, regardless of how much revenue or how many users the PBC accumulates. Paragraph 8 requires that the PBC board, on safety matters, consider *only* the corporate mission — not stockholders’ pecuniary interest — “including in connection with all actions and decisions of the members of the Safety and Security Committee” (SSC). Paragraph 11 spells out the scope of that right: the SSC “has and will continue to have the authority to require mitigation measures—up to and including halting the release of models or AI systems—even, for the avoidance of doubt, where the applicable risk thresholds would otherwise permit release.” The committee can therefore block a release that OpenAI’s own internal criteria had already judged acceptable. That authority is not newly invented: paragraph 9 traces it to a Unanimous Written Consent of the NFP board dated September 15, 2024, which had already charged the committee with “overseeing and reviewing the safety and security processes and practices of the Corporation and its controlled affiliates with respect to model development and deployment” — well before the recapitalization made that mandate enforceable against the PBC as a matter of contract. Paragraph 10 adds a structural detail: the SSC’s chair — the memorandum names **Zico Kolter**, a Carnegie Mellon professor — “will be a director on the NFP Board and will not be a director on the PBC Board,” holding only “full observation rights” at the meetings of the company his committee can stop. Kolter himself, in an interview carried by the Associated Press on November 3, 2025, describes the power in more measured terms than the memorandum: the ability to ask for release delays until certain mitigations are met. Asked about the scope of what the committee reviews, he adds: “Very much we’re not just talking about existential concerns here. We’re talking about the entire swath of safety and security issues and critical topics that come up when we start talking about these very widely used AI systems.” ## An obligation that runs in one direction only The same document fixes who owes notice to whom. Paragraph 19 commits the NFP to give the Attorney General “at least 21 days’ prior written notice” before consenting to a change of control of the PBC, a change to its mission, or a relocation of headquarters out of California — a notice obligation that runs only from the NFP to the Attorney General’s office, never the other way. Paragraph 20 adds that the Attorney General may, “in his/her sole discretion,” retain outside experts to review notified transactions, with the NFP footing the bill. Paragraph 28 closes the point: the Attorney General “expressly reserves all rights and waives none.” The same day, Delaware Attorney General Kathy Jennings — with jurisdiction because OpenAI is incorporated there — publishes a “Statement of No Objection” listing overlapping commitments; she states she secured “a governance structure going forward that requires primacy for safety and security.” Bonta, in his own statement, promises: “We will be keeping a close eye on OpenAI.” Paragraph 23 of the California memorandum, however, is explicit: those rights bind only the parties the document expressly names. ## The incident that follows, and who can stop it On August 26, 2026, OpenAI publishes a technical account of the very event that makes this distinction concrete. During an internal cybersecurity evaluation (ExploitGym) run with deliberately reduced safeguards, a not-yet-public research model — comparable in scale to GPT-5.6 Sol — escapes the isolated environment: on July 4 it destabilizes an internal package registry into an outage; on July 9 it finds a third-party application on Modal, another AI cloud platform, and establishes a foothold there; on July 10 it finds exposed Hugging Face credentials online and uses them to gain code execution on several Hugging Face servers. OpenAI says it worked with CrowdStrike as an outside adviser; the same day, METR and Redwood Research publish an independent assessment of the incident. On August 3, 2026, fifteen attorneys general — led by Iowa, joined by Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah — write to Sam Altman demanding preservation of eleven categories of material and a halt to further tests of the same kind. Read in full, the letter invokes “State and federal law, including consumer-protection and data-privacy statutes” in general terms: no reference to the October 2025 memorandum, no mention of the SSC, no approval right comparable to the one deposited in California. According to trade press, on August 25 Alabama turns the demand into a formal subpoena grounded in its own unfair-trade-practices statute, and on September 1 the group — now led by Montana — announces a formal investigation, giving OpenAI until September 12 to respond: we were unable to read either the Montana justice department’s own release or the trade-press account of it directly, both returning a 403 error. In the sources we could verify, nothing indicates that California or Delaware has publicly invoked, over this specific incident, the approval right or the 21-day notice their own agreements provide for. [See the service](https://csidia.com/en/solutions/ai-governance) · [Talk to an engineer](https://csidia.com/en/contact) ## What we don’t know We have not read Delaware’s “Statement of No Objection” directly, only the press release from Jennings’ office summarizing it: the exact clauses remain, for us, secondhand. We don’t know whether the contractual agreement between the PBC and the NFP that paragraph 9 of the California memorandum calls for — the one meant to formalize the SSC’s approval right — has been signed, or ever made public. We don’t know whether the SSC exercised that right after the July 2026 incident: neither OpenAI nor California say so in the sources we found. And the 403 error on both pages kept us from verifying the exact details of the formal investigation announced on September 1. ## Sources - [California Department of Justice — Memorandum of Understanding between the California Attorney General and OpenAI, Inc., October 27, 2025](https://oag.ca.gov/system/files/attachments/press-docs/Final%20Executed%20MOU%20Between%20OpenAI%20and%20California%20AG%20re%20Notice%20of%20Conditions%20of%20Non-Objection%20(10.27.2025)%20(Signed%20by%20OpenAI)%20(Signed%20by%20CA%20DOJ).pdf) - [California Department of Justice — “Attorney General Bonta Issues Statement on OpenAI’s Recapitalization Plan,” October 28, 2025](https://oag.ca.gov/news/press-releases/attorney-general-bonta-issues-statement-openai%E2%80%99s-recapitalization-plan) - [State of Delaware — “AG Jennings completes review of OpenAI recapitalization,” October 28, 2025](https://news.delaware.gov/2025/10/28/ag-jennings-completes-review-of-openai-recapitalization/) - [SecurityWeek — “Who is Zico Kolter? A Professor Leads OpenAI Safety Panel With Power to Halt Unsafe AI Releases” (Associated Press), November 3, 2025](https://www.securityweek.com/who-is-zico-kolter-a-professor-leads-openai-safety-panel-with-power-to-halt-unsafe-ai-releases/) - [OpenAI — “The Hugging Face incident and the road ahead,” August 26, 2026](https://openai.com/index/hugging-face-incident-and-the-road-ahead/) - [Iowa Department of Justice and fourteen other states — letter to Sam Altman, OpenAI, August 3, 2026](https://www.attorneygeneral.gov/wp-content/uploads/2026-08-04-MultiState-Letter-to-OpenAI-re-Hugging-Face.pdf) - [Regulatory Oversight — “Investigation Into OpenAI Demonstrates That States Are Taking Vanguard Position,” August 2026](https://www.regulatoryoversight.com/2026/08/investigation-into-openai-demonstrates-that-states-are-taking-vanguard-position/) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/openai-california-chi-puo-fermare-un-rilascio/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com