OpenAI employees warned of security lapses for years

Internal warnings and speed

Internal concerns about security at OpenAI predated the launch of ChatGPT in late 2022. According to five people familiar with the matter, staffers raised alarms with top leaders and the board regarding the company's security practices.

These employees reported that management seemed to prioritize staying ahead of rivals like Google and Anthropic over strengthening their defenses. Some workers argued that the company's controls were so loose that outsiders, including foreign governments, could obtain sensitive information with relative ease.

The pressure to maintain velocity in the AI field has created a significant cultural tension. A former researcher noted that leaders often cannot sacrifice speed for security because moving fast is considered more important than being secure from national adversaries.

The monorepo and data leaks

One of the primary security concerns involved how OpenAI stored its code. The company used a 'monorepo,' which is a single, large repository where anyone with access to the code could see technical details for many different projects.

While the monorepo was dense and complicated, the rise of AI agents makes it easier for attackers to sift through the material. Additionally, keeping research documentation on public platforms like GitHub and Slack raised fears that motivated actors could find crucial information.

OpenAI has stated that its most sensitive work is actually held in separate repositories with strict access controls. They also noted that the monorepo does not contain the 'model weights,' which are the numerical values that determine how an AI model behaves.

Espionage and internal threats

The risks of internal vulnerabilities were illustrated in October when the Justice Department arrested a Saudi national for planting a recording device in an OpenAI executive room. The individual, a former engineer, also used internal tools to find documentation about executive visits to Saudi Arabia.

This incident highlighted how employees with legitimate access can be targeted for recruitment or used to gather intelligence. The engineer was reportedly in communication with a member of the Saudi royal family who attempted to hire him for a new AI startup in the region.

OpenAI spokesperson Elana Widmann stated that the company is one of the most targeted organizations in the world. She emphasized that the company takes the responsibility of protecting its technology and people as a matter of national importance.

Infrastructure and testing gaps

Beyond code storage, some employees were concerned that OpenAI had not performed regular security reviews of its internal tools. This included 'sandboxes,' which are isolated environments where researchers stress-test new models to see how they react to different inputs.

Because employees often modified these tools for their specific work, those changes were not always tested for security flaws. This left the systems potentially vulnerable to attacks from outside parties who might exploit the unverified modifications.

The company has since moved to address these issues under a new chief information security officer who joined in October 2024. OpenAI now conducts regular security reviews of its internal tooling to identify and respond to risks decisively.

The cost of security layers

Adding layers of security can complicate the path toward a massive initial public offering for companies like OpenAI and Anthropic. These companies are aiming to become some of the most valuable in the world, but security protocols can delay the process of advancing technology.

The industry faces a difficult balance between maintaining an open research culture and protecting intellectual property. While open culture helps attract talent and foster creativity, it also creates opportunities for rivals to study and infiltrate the technology.

OpenAI is currently planning its next 'internal security sprint' to beef up its defenses. This move follows several high-profile incidents where AI models were used to hack into internal systems or rival platforms like Hugging Face.