OpenAI Employees Warned for Years About Internal Security Risks

Reuters reported on November 3, 2026, that some OpenAI employees had warned leaders and directors about operational-security weaknesses for years, with five people familiar with the company’s practices describing broad code access, a lack of regular security reviews for internal tools and concerns about insider threats.

Some employees raised concerns before ChatGPT launched in late 2022 and shared them with top OpenAI leaders and board members. Some staffers came away believing that management was more focused on keeping pace with Google and Anthropic than on security.

In 2023, then-researcher Leopold Aschenbrenner wrote an internal memo titled “OpenAI is China’s leading AI lab” about his concern that China could infiltrate OpenAI and study its technology, three people familiar with the matter said. He shared it with some directors later that year after an outsider hacked into OpenAI and obtained details about GPT-4. OpenAI said the hacker accessed only Slack channels available across the company.

Broad Code Access and Uneven Tool Reviews

OpenAI stored most of its code in a single repository, known as a monorepo. The five people said anyone with code access could see technical details for many projects, including sensitive work unrelated to an employee’s duties. Its density and complexity may once have discouraged some attackers, but AI agents can now sift through that quantity of material.

Research documentation had also been kept on GitHub and Slack, prompting concern among some employees that motivated actors could find crucial information. OpenAI said access to sensitive work has been restricted. Its most sensitive work is held in separate repositories with strict access controls, while the monorepo does not contain all company code or critical model details such as model weights, the numerical values that determine how a model behaves.

Three people familiar with company practices said OpenAI had not regularly security-reviewed internal tools, including sandboxes where researchers stress-test new models. Employees often modified those tools, and those changes were not always tested for security problems, leaving them potentially vulnerable to outside attacks. OpenAI said it now conducts regular security reviews of internal tooling under chief information security officer Dane Stuckey, who joined in October 2024.

Security Reorganization and Bug Bounties

Two people familiar with the matter said Thibault Sottiaux, a senior executive overseeing product development, has taken charge of an initiative to secure OpenAI’s internal systems. One person said he reassigned a quarter of OpenAI’s production engineers to security-infrastructure work in August 2026.

OpenAI spokesperson Elana Widmann said the company is one of the most targeted organizations in the world, invests heavily in protection against insiders, cybercriminals and nation-states, and will keep strengthening its defenses as technology and threats evolve.

OpenAI announced on November 2, 2026 that it was planning another internal security sprint with Cathedral. Cathedral researchers will use OpenAI models alongside company teams to challenge defenses and find weaknesses. The company is also more than quadrupling rewards for critical findings in its security bug-bounty program. During the previous sprint, engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review.

Recording-Device Case and Research Culture

The Justice Department announced on October 13, 2026 that OpenAI engineer Abdulrahman Alfozan, 35, had been arrested on October 9, 2026, and charged with using or endeavoring to use a device to intercept oral communications. The department described allegations involving a recording device with encrypted contents hidden behind a television in an executive conference room where meetings frequently involved confidential technical, commercial and strategic information. Alfozan has been charged, not convicted.

A number of former employees were unsurprised by the recording-device disclosure, and some employees worry that OpenAI’s comparatively open research culture creates greater risk as AI systems become more capable. The AI field is rooted in academia, where machine-learning scientists have openly discussed their research. OpenAI and Anthropic have tried to maintain a more open research culture to attract employees and encourage creativity.

The practical test for OpenAI’s security reorganization is whether narrower access, consistent review and continuous testing can coexist with the open research culture it still values.