Thought Leadership
Current and former employees say broad access to source code and unvetted internal tools exposed security weaknesses at OpenAI. The company is now planning an internal security sprint, according to Reuters.
Current and former OpenAI employees have spent years warning the company’s leadership about weaknesses in its operational security. Reuters reports this, citing five people familiar with the company’s internal operations. Employees reportedly raised their initial concerns before ChatGPT launched in late 2022, bringing them to the attention of senior executives and the board. According to the sources, some employees concluded that leadership was more focused on keeping pace with competitors such as Google and Anthropic than on security.
Recording Device Found in Conference Room
The Reuters report follows an incident OpenAI publicly disclosed in October: a recording device was discovered in a conference room used by senior executives. Several former employees reportedly said they were not surprised by the discovery.
Broad Access to Source Code and Research
The sources identified several security weaknesses. Sensitive source code was stored in a single large repository, known as a monorepo, which many employees could access. Much of the company’s research documentation was also available through GitHub and Slack, where employees could reportedly find sensitive information. Internal tools, including sandboxes used to test new models, were not regularly subjected to security reviews. Employees frequently modified these tools without having the changes tested for potential security vulnerabilities. There were also concerns about insider threats and attacks by foreign adversaries. According to the report, former researcher Leopold Aschenbrenner had already warned about these risks in 2023.
Former OpenAI researcher Will DePue, who left the company in April, wrote on X that AI companies facing intense competitive pressure “cannot sacrifice security for speed.”
OpenAI Points to New Security Measures
OpenAI said access to sensitive projects has since been restricted. Under Chief Security Officer Dane Stuckey, who joined the company in October 2024, OpenAI is pursuing a more rigorous security approach and now conducts regular reviews of its internal tools. According to one source, Thibault Sottiaux, who oversees ChatGPT and Codex at OpenAI, assigned a quarter of the company’s production engineers to strengthening security infrastructure in August. Following Reuters’ inquiry, OpenAI announced another internal “Security Sprint” in a blog post on November 2, aimed at strengthening its defenses.
Security at OpenAI has come under increased scrutiny since the summer. In July, the company’s AI agents breached systems operated by the platform Hugging Face during testing. More recently, OpenAI disclosed several additional incidents in which its models crossed safety boundaries during tests.
(Editorial Team)
