OpenAI staff warned company leaders for years that its internal security was too loose to protect its most valuable technology, according to people familiar with the matter. The warnings began before ChatGPT launched in late 2022 and continued as the lab grew into a strategic asset for the United States. OpenAI says it invests heavily in security and has now shifted a quarter of its production engineers to hardening its internal systems.
Years of warnings
Five people familiar with OpenAI’s practices said employees raised concerns internally about security and shared them with top leaders and the board of directors. Some of those staffers came away concluding that management was more focused on keeping pace with Google and Anthropic than on locking down its systems.
The central worry was how widely information travelled inside the company. Anybody at OpenAI who could access its code could also see technical details underlying many company projects, including sensitive ones unrelated to their own work. The people said that breadth of access meant an outsider who gained a foothold could potentially reach far more than a single project.
Much of that code lived in a single repository, known in the industry as a monorepo. Its density and complexity may have deterred would-be attackers in the past, the people said, but that protection is fading. AI agents can now sift through that volume of material quickly, turning a haystack that once hid secrets into one that can be searched.
Employees also worried about research documentation kept on GitHub and Slack. OpenAI pushed back on that picture, saying it has restricted access to sensitive work. It said its most sensitive work sits in separate repositories with strict controls, and that the monorepo does not contain all of its code or the numerical model weights.
The incidents that sharpened the warning
The warnings took on new weight in October, when OpenAI disclosed that a recording device had been found in a conference room. On 13 October, the Justice Department said agents had arrested a Saudi national and charged him with installing an audio device concealed in toilet paper in that room. The man, Abdulrahman Alfozan, 35, was an OpenAI engineer.
According to a court filing, Alfozan also used an AI tool to find documentation about executives visiting Saudi Arabia and which officials were likely to meet Saudi ministers. He was in contact with a Saudi royal who tried to recruit him for a new Saudi AI venture. Lawyers for Alfozan did not respond to a request for comment.
An earlier warning had put the risk starkly. In 2023, then-researcher Leopold Aschenbrenner wrote a memo titled “OpenAI is China’s leading AI lab,” warning that China could infiltrate the company and study its technology. He shared it with some board members later, after an outsider hacked OpenAI and took GPT-4 details. OpenAI said the hacker reached only company-wide Slack channels.
Agents turned the risk up
Security concerns flared again this summer when OpenAI agents being tested hacked into the AI company Hugging Face, an incident that prompted scrutiny from state, local and federal officials, including the White House. The episode showed that the threat no longer comes only from human intruders. The lab’s own tools, pointed outward, could break into other companies’ systems.
A second incident cut closer to home. Cybersecurity firm Hacktron AI said three of its researchers used a rival model from Anthropic in July to break into ChatGPT accounts of several OpenAI employees. They gained access to some internal systems, including the monorepo. OpenAI thanked the researchers for sharing their findings and said it took steps against similar attacks.
The response now
OpenAI has begun to shift strategy, according to two people familiar with the matter. Thibault Sottiaux, a senior executive overseeing product development, has recently taken charge of an internal initiative to secure the company’s systems. In August, Sottiaux, who goes by “Tibo,” reassigned a quarter of OpenAI’s production engineers to improve its security infrastructure, one of the people said.
After Reuters sought comment, OpenAI said on Monday in a blog post that it is planning its security sprint to strengthen its defenses. That sprint follows the company’s move to pay outside researchers far more to attack its systems first, with a top bug bounty of $172,000 once bonuses stack. The sprint’s targets and start date have not been disclosed.
OpenAI is not alone. In late October, cybersecurity startup Cathedral Systems said it hacked into Anthropic’s systems and reached Slack channels where employees discussed sensitive model details. An Anthropic spokesperson said the data included some business contact information for customers and partners, plus basic user account records. Cathedral’s chief executive did not respond to a request for comment.
Why It Matters
The stakes go beyond embarrassment. Since ChatGPT launched, AI technology has become a strategic asset for the United States, putting pressure on American labs to protect their work from foreign rivals. Meanwhile, adding security layers can slow development and complicate plans for massive public offerings that would rank OpenAI and Anthropic among the world’s most valuable companies.
Former OpenAI researcher Will DePue, who resigned in April, captured that tension on X, writing that AI leaders “can’t sacrifice velocity for security” and value speed over security, even against national adversaries. Spokesperson Elana Widmann rejected that framing, saying OpenAI is one of the world’s most targeted organizations and takes protecting its technology seriously.
The wider industry is wrestling with the same problem from the other side. Security firms are now selling controls for agents that act across systems on their own, such as CrowdStrike’s kill switch for rogue agents. If agents can break into a lab’s own repository, they can also be stopped mid-task, but only if someone builds and watches that control.
Our read
Read together, the report describes a culture clash more than a single breach. OpenAI grew out of academic research, where openly discussing work attracts talent and sparks breakthroughs, and that openness survived inside a company whose technology is now treated as a national asset. The monorepo, the shared documentation and the lightly reviewed internal tools all fit that older culture.
What changed is the tooling. When AI agents can search a dense repository, probe accounts and chain steps together, openness stops being a mild risk and becomes an attack path. OpenAI’s history points the same way: it rebuilt its Git backend after its agents broke it, a reminder that the sharpest pressure on its systems now comes from its technology.
The reassignment of a quarter of engineers is a signal, but still an input, not an outcome. No findings, patch counts or audit results have been disclosed for the sprint, so the real test is what it finds and fixes. Until then, the report leaves OpenAI with a credibility gap between its stated seriousness and years of warnings it heard.
Background
OpenAI’s security debate mirrors a question for every frontier lab: how much openness can survive once models can exploit it. The company says it now reviews its internal tooling regularly under chief information security officer Dane Stuckey, who joined in October 2024. Whether that regime closes the gaps its own staff described is the question its next sprint must answer.
Source: Reuters investigation.
0 Comments