When OpenAI disclosed in October that it found a recording device planted in an executive conference room, a number of former employees had the same reaction — they were not surprised.
Even before OpenAI launched ChatGPT in late 2022, some company staffers raised concerns internally about its security practices, according to five people familiar with the matter. Employees shared their concerns with top OpenAI leaders and the board of directors, the people said, adding that some staffers came away from those interactions concluding that management was more focused on keeping pace with competitors like Google and Anthropic than on security.
These workers argued that OpenAI’s controls were so lax that outsiders, including foreign governments, could obtain sensitive information about the AI lab’s technology with relative ease, the people said. For example, anybody at OpenAI who could access its code could see the technical details underlying many company projects.
OpenAI has begun to shift strategy to address security issues, according to two people familiar with the matter. Thibault Sottiaux, a senior executive overseeing product development, has recently taken charge of an internal initiative to secure OpenAI’s internal systems, they said. In August, Sottiaux, who goes by “Tibo,” reassigned a quarter of OpenAI’s production engineers to improve its security infrastructure, one of the people said.
The internal warnings, including years of employee complaints to leadership about internal vulnerabilities, certain details of which have not been previously reported, shed light on a tension within the AI field. Since ChatGPT launched in late 2022, AI technology has become a strategic asset for the US, putting pressure on American companies to protect their technology from foreign rivals.
But adding security layers can also delay the process of advancing AI technology and possibly complicate OpenAI’s and Anthropic’s plans for massive initial public offerings that would make them among the most valuable companies in the world.
Will DePue, a former OpenAI researcher who resigned from the company in April of this year, wrote in a post on X that with competition so tense, AI leaders “can’t sacrifice velocity for security. It is more important to them to move fast than to be secure, even from our greatest national adversaries.”
When asked about employees’ concerns and their view that management did not act on these issues, OpenAI spokesperson Elana Widmann said that OpenAI is one of the most targeted organizations in the world. As a result, the company invests heavily in its security program to protect against attacks from insiders, cybercriminals and nation-states, she said.
“Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance,” Widmann said. “The actions we’ve taken recently show that program doing its job: identifying risks and responding decisively. We’ll keep strengthening our defenses as technology and threats evolve.”
RESEARCH WIDELY AVAILABLE
On October 13, the Justice Department said US federal agents arrested a Saudi national and charged him with installing a hidden audio recording device, concealed in toilet paper, in an executive conference room. Abdulrahman Alfozan, 35, was an OpenAI engineer at the time.
Alfozan also used an AI tool meant for OpenAI employees to find internal documentation about executives visiting Saudi Arabia and which OpenAI officials were most likely to attend meetings with Saudi ministers, according to a court filing. Alfozan was in regular contact with a Saudi royal who tried to recruit him for a new AI venture launching in Saudi Arabia. Lawyers for Alfozan did not respond to a request for comment.
Some employees have long been concerned about the wide availability of information within OpenAI, the five people familiar with OpenAI’s practices said.
Anybody at OpenAI who could access its code could also see the details underlying many of the company’s projects, including sensitive ones unrelated to an employee’s work. That is because OpenAI stored most of its code in a single repository, known in the industry as a “monorepo,” the people said. The monorepo was dense and complicated, which may have deterred some would-be attackers in the past. Now, AI agents can sift through that amount of material.
In the past, OpenAI has kept much of its research documentation on GitHub and Slack, raising concerns among some employees that motivated actors could still find crucial information, the five people said. But one of the sources and OpenAI said the company has restricted access to sensitive work.
OpenAI emphasized that much of its most sensitive work is held in separate code repositories with strict access controls. And it said the monorepo does not contain all of its code or critical details of the company’s models, including the numerical values that determine how a model behaves, known as the model weights.
Another issue is that OpenAI had not done regular security reviews of its internal tools, such as the so-called sandboxes where researchers stress-test new models, three people familiar with the company’s practices said. Employees often modified those tools for their work, but those changes were not always tested for security problems, leaving them potentially vulnerable to attacks from outsiders, the three people said.
The company said it has a strong approach to security under its chief information security officer, Dane Stuckey, who joined in October 2024. OpenAI said it now conducts regular security reviews of its internal tooling.
