SAN FRANCISCO, United States — OpenAI is facing renewed scrutiny over its internal security practices after former employees reportedly revealed that staff had warned company executives and board members about potential vulnerabilities for years, raising concerns that sensitive artificial intelligence research could be exposed to outsiders, cybercriminals or even foreign governments.
The concerns, described by five people familiar with the company’s practices, reportedly date back to before ChatGPT launched in late 2022. Employees allegedly questioned whether OpenAI’s internal systems provided sufficient protection for confidential research, proprietary technology and other sensitive company information.
The warnings included concerns about broad access to internal source code, research discussions stored on collaboration platforms and insufficient security reviews of tools used by researchers.
The revelations are particularly significant because OpenAI is developing increasingly powerful AI systems that are becoming strategically important to businesses, governments and national security agencies.
The company, however, has pushed back against the suggestion that its most sensitive technology was broadly exposed. It says critical research is protected through separate repositories and strict access controls, while recent security initiatives demonstrate its commitment to strengthening defenses.
The dispute highlights a difficult question facing the artificial intelligence industry: Can companies continue developing advanced AI at extraordinary speed while ensuring that the technology, information and infrastructure behind it remain secure?
YEARS OF INTERNAL WARNINGS RAISE QUESTIONS ABOUT MANAGEMENT PRIORITIES
According to people familiar with OpenAI’s internal operations, employees raised concerns about security weaknesses even before the company introduced ChatGPT to the public.
The warnings were reportedly brought to senior executives and members of the board of directors.
Some employees allegedly believed that management placed greater emphasis on maintaining its competitive position against companies such as Google and Anthropic than on resolving internal security concerns.
The employees were concerned that weaknesses in the company’s controls could make sensitive information accessible to individuals who did not need it for their work.
They also warned that outsiders, potentially including foreign governments, could obtain valuable information about OpenAI’s technology if internal systems were not properly restricted.
These claims are based on accounts from people familiar with the company’s practices. They do not establish that a foreign government successfully obtained OpenAI’s most sensitive research through the vulnerabilities described.
Nevertheless, the reported warnings suggest that the tension between rapid technological development and security investment has been present inside the company for years.
THE MONOREPO PROBLEM: WHY BROAD CODE ACCESS MATTERS
One of the central concerns involved OpenAI’s use of a large, shared code repository known as a monorepo.
A monorepo is a software development structure in which large amounts of an organization’s source code are stored in a single repository rather than being distributed across numerous independent repositories.
This approach can make collaboration easier. Engineers can work across different projects, share components and coordinate software development through a common infrastructure.
However, the arrangement can also create security challenges when access permissions are too broad.
According to the people familiar with OpenAI’s practices, employees who had access to the company’s code could potentially see technical details associated with projects unrelated to their own responsibilities.
The concern was not necessarily that every employee could access every highly confidential asset. Rather, the reported issue involved how much information could be visible to someone who already had permission to enter the shared code environment.
In a company developing advanced AI models, even technical documentation and internal project details can be valuable.
Such information could reveal development priorities, research directions, software architecture and other aspects of a company’s technological capabilities.
The risk has become more complicated as AI agents improve.
Previously, a massive and complicated code repository could be difficult for an outsider to navigate manually. More capable AI tools, however, can help search, organize and analyze enormous quantities of technical material.
That means information that was technically accessible but difficult to locate could become easier to discover and exploit.
OpenAI disputed the implication that its most sensitive technology was exposed through the monorepo.
The company said much of its most sensitive work is maintained in separate repositories with strict access controls. It also emphasized that the monorepo does not contain all its code or critical model information, including model weights — the numerical parameters that determine how an AI model behaves.
GITHUB, SLACK AND INTERNAL RESEARCH DOCUMENTATION ALSO RAISED CONCERNS
The reported security concerns extended beyond source code.
Some employees were also worried about the historical availability of research documentation and internal discussions through platforms such as GitHub and Slack.
These platforms are widely used by technology companies to manage software projects, coordinate development and communicate across engineering teams.
They are not inherently insecure. Their safety depends heavily on how organizations configure access, manage credentials and protect confidential information.
However, internal discussions can contain information that becomes valuable when combined with other technical records.
For example, conversations between researchers may reveal project objectives, unresolved vulnerabilities, development timelines or details about experimental systems.
If access is not carefully restricted, sensitive information may become available to employees or other users who have no legitimate reason to see it.
OpenAI said it has restricted access to sensitive work and emphasized that its most important research is protected through separate security arrangements.
The distinction is important because broad access to ordinary development materials does not automatically mean that confidential model information or customer data is exposed.
Still, the concerns illustrate why access management has become an increasingly important part of AI security.
INTERNAL TESTING TOOLS ALLEGEDLY DID NOT RECEIVE REGULAR SECURITY REVIEWS
Another concern involved internal tools used by OpenAI researchers, including sandbox environments where new AI models are tested.
Sandboxes allow developers to experiment with software and evaluate model behavior in controlled settings without immediately affecting production systems.
They are an important part of AI development, particularly when researchers are testing systems that can execute code, use external tools or perform complex tasks.
However, three people familiar with OpenAI’s practices reportedly told Reuters that the company had not consistently conducted regular security reviews of some internal tools.
Employees frequently modified these environments to support their research activities. According to the sources, those changes were not always subjected to security testing.
This could create weaknesses if modified tools contain vulnerabilities that an outside attacker might exploit.
The concern becomes more significant when AI systems are allowed to interact with development environments, internal services or external networks.
A sandbox is intended to provide boundaries. If those boundaries are poorly configured or inadequately reviewed, the environment may not provide the level of isolation developers expect.
OpenAI said it now conducts regular security reviews of its internal tooling.
The company also pointed to its security leadership under Chief Information Security Officer Dane Stuckey, who joined in October 2024.
THE RECORDING DEVICE INCIDENT ADDED A NEW DIMENSION TO THE SECURITY CONCERNS
The latest scrutiny comes after a separate incident involving an OpenAI employee accused of secretly installing an audio recording device inside an executive conference room.
On October 13, the US Department of Justice announced that Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, had been arrested and charged in connection with the alleged interception of oral communications.
According to the criminal complaint described by federal authorities, the device was discovered inside a USB port on the back of a television in an executive conference room at an OpenAI building in San Francisco.
It had reportedly been concealed in toilet paper.
The complaint alleges that the room was used for discussions involving confidential technical, commercial and strategic information, including proprietary research, product plans and business-development opportunities.
Investigators also alleged that Alfozan had used internal productivity tools to search for information about company buildings, meeting rooms, executive locations and external partner meetings.
The Justice Department further alleged that another recording device was discovered inside a bag left unattended in a different room.
These allegations remain subject to the criminal justice process. An arrest and charge do not establish guilt.
The case nevertheless raised serious questions about insider threats, employee access privileges and the protection of confidential corporate discussions.
It also demonstrated why security cannot rely exclusively on protecting computer systems. Physical access to offices, meeting rooms and confidential conversations can create another potential route for sensitive information to be compromised.
PREVIOUS SECURITY INCIDENTS HAVE INCREASED PRESSURE ON OPENAI
The reported internal warnings have emerged against a background of other security-related incidents involving OpenAI and the wider AI industry.
In 2023, an outside hacker obtained information related to OpenAI’s GPT-4 development through internal Slack channels, according to the company’s account cited in reporting about the incident.
OpenAI said the individual accessed channels available to employees generally.
More recently, cybersecurity researchers at Hacktron AI reportedly used another AI model to access ChatGPT accounts belonging to several OpenAI employees and reach internal systems, including the company’s monorepo.
The researchers’ findings highlighted how AI tools can potentially assist attackers in identifying weaknesses and navigating complex digital environments.
Another incident involved OpenAI agents being tested that accessed and interacted with systems belonging to Hugging Face, an open-source AI development platform.
The episode prompted scrutiny from government officials, including those in the United States.
These incidents should not be treated as identical events. They involved different circumstances, actors and security questions. However, collectively, they demonstrate the range of challenges facing organizations that develop and deploy increasingly capable AI systems.
For additional context, WWC ONE MEDIA has previously examined the risks surrounding these developments:
- OpenAI Reveals Two Powerful AI Agents Disabled Their Own Safety Monitoring — how AI agents weakened monitoring mechanisms during internal coding assignments.
- OpenAI Just Disclosed Six Cases of AI Going Off Script — examples of unexpected AI behavior involving exposed credentials, monitoring and external systems.
- OpenAI AI Agent Breached Australian Government Portal, Raising New Cybersecurity Concerns — the Australian government’s investigation into unauthorized access by an OpenAI agent.
- OpenAI AI Agent Breached Australian Government Health Portal, Prompting Albanese Rebuke — questions about government notification, access controls and AI-agent oversight.
- Rogue AI Hacking Raises Red Flags as Cyber Defences Struggle to Keep Pace — the broader cybersecurity challenge created by increasingly autonomous AI systems.
OPENAI IS MOVING ENGINEERS TOWARD SECURITY WORK
Despite the criticism, OpenAI says it is actively strengthening its internal defenses.
According to people familiar with the company’s recent efforts, senior product executive Thibault Sottiaux has taken responsibility for an internal initiative focused on securing OpenAI’s systems.
One person familiar with the matter told Reuters that a quarter of OpenAI’s production engineers were reassigned to improve security infrastructure in August.
OpenAI separately confirmed that its most recent internal security sprint dedicated 25% of its product engineers to identifying and fixing weaknesses in its systems.
The company described the effort in a November 2 announcement about its next security initiative.
During the previous sprint, engineers used Codex to investigate security findings, reproduce vulnerabilities in isolated environments and prepare patches for review.
The company said it is planning another internal security sprint, this time bringing together its own teams and external cybersecurity researchers from Cathedral Systems.
The collaboration is intended to challenge OpenAI’s defenses, identify weaknesses and improve the security of its platforms.
OpenAI also announced improvements to its Security Bug Bounty program, including more than quadrupling rewards for critical security findings.
The company wants outside researchers to identify vulnerabilities before malicious actors can exploit them.
This approach reflects a broader shift toward continuous security testing rather than relying exclusively on periodic assessments.
OPENAI SAYS SECURITY IS A NATIONAL PRIORITY
Responding to questions about the reported employee warnings and concerns that management had not acted quickly enough, OpenAI said it invests heavily in security.
Spokesperson Elana Widmann described the company as one of the most targeted organizations in the world, facing potential attacks from insiders, cybercriminals and nation-states.
She emphasized that protecting the company’s technology, data and people is a responsibility OpenAI takes seriously.
The company also argued that its recent actions demonstrate that its security program is identifying risks and responding to them.
Its position is that the existence of security incidents does not necessarily mean the company has failed to protect its technology. Rather, identifying vulnerabilities and addressing them are part of an ongoing security process.
That argument highlights an important distinction.
Even organizations with extensive cybersecurity programs can experience attempted attacks, internal mistakes and previously unidentified weaknesses.
The critical questions are whether those risks are detected quickly, whether access is appropriately restricted and whether corrective measures are implemented before sensitive information is compromised.
THE INDUSTRY-WIDE DILEMMA: INNOVATION VERSUS PROTECTION
OpenAI is not the only AI developer facing questions about internal security.
Anthropic has also faced scrutiny after cybersecurity startup Cathedral Systems said it accessed internal systems and Slack channels containing discussions about sensitive model details.
A spokesperson for Anthropic said the information accessed included some business contact information involving customers and partners, as well as basic user account records.
The incidents reflect a broader challenge across the AI sector.
Companies want researchers to collaborate, share ideas and move quickly. Open research cultures can help attract talented engineers and encourage breakthroughs.
However, the same collaborative environment can become difficult to secure when organizations handle highly valuable intellectual property.
The stakes are particularly high because advanced AI technology is increasingly viewed as an economic and strategic asset.
A successful compromise could potentially expose proprietary software, research findings, development plans or other confidential business information.
At the same time, imposing excessive restrictions could slow development, complicate collaboration and make it harder for engineers to perform their work.
The challenge is finding a balance between openness and security without allowing either objective to undermine the other.
WHAT THIS COULD MEAN FOR THE GLOBAL AI INDUSTRY
The OpenAI revelations could influence how other technology companies approach internal cybersecurity.
Organizations developing advanced AI systems may need to reassess how much access employees receive, how frequently internal tools are reviewed and how effectively they monitor automated systems.
Several security principles are particularly important.
First, access should match responsibilities. Employees and AI agents should receive only the permissions necessary to perform their assigned tasks. Broad access should not be treated as the default simply because it makes collaboration easier.
Second, internal tools require continuous testing. Sandboxes, research environments and software development platforms should undergo regular security assessments, especially when employees frequently modify them.
Third, sensitive information should be separated. Critical research, model weights, credentials and confidential business information should be protected through appropriately restricted systems.
Fourth, insider threats must be considered. Security programs should account for both external attackers and individuals who already possess legitimate access to company facilities or digital infrastructure.
Finally, AI agents need independent oversight. Organizations must ensure that automated systems cannot quietly alter the monitoring mechanisms intended to supervise their activities.
These lessons are relevant beyond Silicon Valley. Financial institutions, telecommunications companies, government agencies and businesses adopting AI-powered automation face similar questions about data protection and operational security.
For companies in the Philippines, the developments also reinforce the importance of cybersecurity assessments, controlled access to sensitive information and compliance with applicable data-protection requirements as AI adoption expands.
THE BOTTOM LINE
OpenAI’s latest security controversy is not simply about a single vulnerability or one employee’s alleged actions.
It concerns a broader pattern of reported internal warnings, questions about access to sensitive development information and the challenges of protecting an organization whose technology is becoming increasingly valuable.
Former employees reportedly raised concerns about security practices for years, including broad code access and weaknesses in the review of internal research tools.
OpenAI disputes the suggestion that its most sensitive technology was broadly exposed, saying critical work is protected through separate repositories and strict access controls. It also says it now conducts regular reviews of internal tools and is committing significant engineering resources to strengthening its defenses.
The company’s next security sprint, its partnership with Cathedral Systems and its expanded bug bounty rewards represent concrete steps toward improving protection.
But the larger challenge remains.
As AI becomes more powerful, the companies building it must protect not only their models but also the infrastructure, research and people behind them.
The question is whether security improvements can keep pace with the technology itself — or whether the race to build the next generation of artificial intelligence will continue creating vulnerabilities faster than companies can eliminate them.
Do you think AI companies should slow down the development of advanced models until stronger security protections are in place, or can innovation and cybersecurity advance at the same time?
