By Deepa Seetharaman
SAN FRANCISCO, Nov 3 (Reuters) – When OpenAI disclosed in October that it found a recording device planted in an executive conference room, a number of former employees had the same reaction — they were not surprised.
Even before OpenAI launched ChatGPT in late 2022, some company staffers raised concerns internally about its security practices, according to five people familiar with the matter. Employees shared their concerns with top OpenAI leaders and the board of directors, the people said, adding that some staffers came away from those interactions concluding that management was more focused on keeping pace with competitors like Google and Anthropic than on security.
These workers argued that OpenAI’s controls were so lax that outsiders, including foreign governments, could obtain sensitive information about the AI lab’s technology with relative ease, the people said. For example, anybody at OpenAI who could access its code could see the technical details underlying many company projects.
OpenAI has begun to shift strategy to address security issues, according to two people familiar with the matter. Thibault Sottiaux, a senior executive overseeing product development, has recently taken charge of an internal initiative to secure OpenAI’s internal systems, they said. In August, Sottiaux, who goes by “Tibo,” reassigned a quarter of OpenAI’s production engineers to improve its security infrastructure, one of the people said.
The internal warnings, including years of employee complaints to leadership about internal vulnerabilities, certain details of which have not been previously reported, shed light on a tension within the AI field. Since ChatGPT launched in late 2022, AI technology has become a strategic asset for the US, putting pressure on American companies to protect their technology from foreign rivals.
But adding security layers can also delay the process of advancing AI technology and possibly complicate OpenAI’s and Anthropic’s plans for massive initial public offerings that would make them among the most valuable companies in the world.
Will DePue, a former OpenAI researcher who resigned from the company in April of this year, wrote in a post on X that with competition so tense, AI leaders “can’t sacrifice velocity for security. It is more important to them to move fast than to be secure, even from our greatest national adversaries.”
When asked about employees’ concerns and their view that management did not act on these issues, OpenAI spokesperson Elana Widmann said that OpenAI is one of the most targeted organizations in the world. As a result, the company invests heavily in its security program to protect against attacks from insiders, cybercriminals and nation-states, she said.
“Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance,” Widmann said. “The actions we’ve taken recently show that program doing its job: identifying risks and responding decisively. We’ll keep strengthening our defenses as technology and threats evolve.”
RESEARCH WIDELY AVAILABLE
On October 13, the Justice Department said US federal agents arrested a Saudi national and charged him with installing a hidden audio recording device, concealed in toilet paper, in an executive conference room. Abdulrahman Alfozan, 35, was an OpenAI engineer at the time.
Alfozan also used an AI tool meant for OpenAI employees to find internal documentation about executives visiting Saudi Arabia and which OpenAI officials were most likely to attend meetings with Saudi ministers, according to a court filing. Alfozan was in regular contact with a Saudi royal who tried to recruit him for a new AI venture launching in Saudi Arabia. Lawyers for Alfozan did not respond to a request for comment.
Some employees have long been concerned about the wide availability of information within OpenAI, the five people familiar with OpenAI’s practices said.
Anybody at OpenAI who could access its code could also see the details underlying many of the company’s projects, including sensitive ones unrelated to an employee’s work. That is because OpenAI stored most of its code in a single repository, known in the industry as a “monorepo,” the people said. The monorepo was dense and complicated, which may have deterred some would-be attackers in the past. Now, AI agents can sift through that amount of material.
In the past, OpenAI has kept much of its research documentation on GitHub and Slack, raising concerns among some employees that motivated actors could still find crucial information, the five people said. But one of the sources and OpenAI said the company has restricted access to sensitive work.
OpenAI emphasized that much of its most sensitive work is held in separate code repositories with strict access controls. And it said the monorepo does not contain all of its code or critical details of the company’s models, including the numerical values that determine how a model behaves, known as the model weights.
Another issue is that OpenAI had not done regular security reviews of its internal tools, such as the so-called sandboxes where researchers stress-test new models, three people familiar with the company’s practices said. Employees often modified those tools for their work, but those changes were not always tested for security problems, leaving them potentially vulnerable to attacks from outsiders, the three people said.
The company said it has a strong approach to security under its chief information security officer, Dane Stuckey, who joined in October 2024. OpenAI said it now conducts regular security reviews of its internal tooling.
OPEN DEBATE VERSUS SECURITY
OpenAI is not the only AI company to face security problems.
In January, a federal jury in San Francisco convicted a former Google employee who was arrested in March 2024 on charges of stealing thousands of pages of confidential information about Google’s AI technology on behalf of China.
In late October, a cybersecurity startup called Cathedral Systems said it hacked into Anthropic’s systems and gained access to Slack channels where employees discussed sensitive model details. An Anthropic spokesperson said the data accessed included some business contact information for customers and partners as well as a set of basic user account records. Cathedral’s CEO did not respond to a request for comment.
OpenAI and Anthropic have tried to maintain a more open research culture to both attract employees and foster creativity that can lead to breakthroughs. The AI field is rooted in academia, where machine-learning scientists have openly discussed their research.
Some OpenAI employees are increasingly worried about this approach as AI grows more capable, according to the five people.
In 2023, Leopold Aschenbrenner, then an OpenAI researcher, wrote an internal memo titled “OpenAI is China’s leading AI lab” about his concerns that China could infiltrate OpenAI and study its technology, three people familiar with the matter said.
Aschenbrenner shared that memo with some board members later that year after an outsider hacked into OpenAI and took details about its GPT-4 model. OpenAI said the hacker accessed only Slack channels available to the whole company.
Security concerns within OpenAI flared up again this summer when OpenAI agents being tested hacked into the AI company Hugging Face, an incident that prompted scrutiny from state, local and federal officials, including the White House.
Cybersecurity firm Hacktron AI said three of its researchers used a rival AI model from Anthropic in July to break into ChatGPT accounts belonging to multiple OpenAI employees and gained access to some internal OpenAI systems, including its monorepo. The incident exposed how advanced AI can now put the AI companies themselves at risk of attack.
OpenAI’s Widmann said the company thanked the researchers for sharing their findings and that it took steps to minimize the risk of similar attacks in the future.
After Reuters sought comment for this story, OpenAI said on Monday in a blog post that it is planning its “next internal security sprint” to beef up its defenses.
(Reporting by Deepa Seetharaman in San Francisco; Editing by Kenneth Li, Edward Tobin and Matthew Lewis)
Comments