OpenAI Staff Reportedly Warned Leaders for Years That Security Was Too Lax
Reuters reports that OpenAI employees warned top leaders and the board about lax internal security, even before ChatGPT launched. OpenAI says its most sensitive work is tightly controlled and that it now reviews internal tools regularly.
Before ChatGPT existed, some OpenAI employees were already worried that anyone with enough patience could walk off with the company's secrets. They told leadership and the board, Reuters reports, citing five people familiar with the matter. Some left those talks convinced that management cared more about keeping pace with Google and Anthropic than about security.
Treat this carefully. These are anonymous accounts, and OpenAI disputes the sharpest version of them. The report does not say model weights leaked. What the report does offer is a rare look at how a leading lab may have organized its own house.
The picture Reuters paints is of a company built for speed and openness. According to the five sources, OpenAI kept most of its code in a single repository, a so-called monorepo, so anyone who could reach the code could see the technical details behind many projects, including sensitive ones unrelated to their job. Research documentation also lived on GitHub and Slack. Three people told Reuters that internal tools, including the sandboxes where researchers stress-test new models, were not regularly reviewed for security, even though employees often modified them.
The monorepo was dense and complicated, which Reuters says may have put off some would-be attackers in the past. That protection is eroding. AI agents can now sift through that much material without getting bored, which turns a messy haystack into a searchable one. It is an irony the industry should not miss: the tools these labs sell are making their own sloppy filing cabinets more dangerous.
"Can't sacrifice velocity for security. It is more important to them to move fast than to be secure, even from our greatest national adversaries." Will DePue, former OpenAI researcher who resigned in April, in a post on X, describing AI leaders
Reuters notes that extra security layers can slow research and could complicate plans by OpenAI and Anthropic for massive initial public offerings.
What OpenAI says it has done
OpenAI pushed back on the characterization. It told Reuters that its most sensitive work sits in separate repositories with strict access controls, and that the monorepo does not hold all of its code or critical details of its models, including the model weights. It says it now runs regular security reviews of internal tools under chief information security officer Dane Stuckey, who joined in October 2024.
Two people told Reuters that Thibault Sottiaux, a senior executive overseeing product development, has taken charge of an internal security push. One of them said he reassigned a quarter of OpenAI's production engineers to security infrastructure in August. That is a big move if accurate, but it rests on one source.
"Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance." Elana Widmann, OpenAI spokesperson, in a statement to Reuters
Widmann said OpenAI is one of the most targeted organizations in the world. After Reuters asked for comment, OpenAI said in a blog post on Monday that it is planning its next internal security sprint.
The backdrop is ugly. On October 13 the Justice Department said agents arrested Abdulrahman Alfozan, 35, an OpenAI engineer at the time, and charged him with installing a hidden audio recording device, reportedly concealed in toilet paper, in an executive conference room. Our earlier report covered the arrest. A court filing, per Reuters, says he also used an internal AI tool to look up executives visiting Saudi Arabia and was in contact with a Saudi royal who tried to recruit him. The allegations are unproven. Alfozan's lawyers did not respond to Reuters' request for comment.
Reuters says Hacktron AI researchers used an Anthropic model in July to break into ChatGPT accounts of OpenAI employees and reach internal systems, including the monorepo. It also recounts a 2023 outsider hack that took details about GPT-4, which OpenAI says only touched company-wide Slack channels. This week OpenAI announced a partnership with the startup that says it hacked Anthropic, which we covered separately.
Here is the uncomfortable read. Sprints and bounties are the right instincts, but they are reactive. If Reuters' sources are right, the warnings came years before the arrest. OpenAI now has to show the security push outlasts the news cycle.
