Some OpenAI employees spent years warning the company's leaders and board that its everyday security was too weak, including code that almost anyone with access could browse, Reuters reported Tuesday. The account, drawn from five people familiar with the matter, matters to companies and governments that run sensitive work through OpenAI's models and to investors weighing planned public listings of frontier AI developers.
What Happened
According to Reuters, some staff took their concerns to top leaders and the board, in some cases before ChatGPT launched in late 2022. Some concluded that management put keeping pace with Google and Anthropic ahead of security. Former employees argued that outsiders, including foreign governments, could obtain sensitive technical information with relative ease.
Two practices drew particular concern. Five people told Reuters that OpenAI kept most of its code in a single shared repository, known as a monorepo, so anyone with code access could see details of many projects, including sensitive ones unrelated to their work. Sources said AI agents, software that carries out tasks on its own, can now sift through such material. Three people said OpenAI did not regularly review the security of internal tools such as the sandboxes, or isolated test environments, where researchers stress-test models.
OpenAI told Reuters its most sensitive work sits in separate repositories with strict access controls, that the monorepo does not hold all of its code or critical details such as model weights, and that it now reviews internal tooling regularly. Spokesperson Elana Widmann said it is among the world's most targeted organizations. One person said Thibault Sottiaux, a senior product executive who leads an internal security effort, moved a quarter of OpenAI's production engineers onto security infrastructure in August. After Reuters asked for comment, OpenAI said in a blog post Monday that it is planning its "next internal security sprint."
Why It Matters
For boards and executives, a frontier lab's security is part of their own supply chain: organizations that send data or code through these models inherit some of the lab's exposure. Reuters noted that tighter controls could slow development and complicate planned initial public offerings by OpenAI and Anthropic.
Context
Reuters linked the warnings to a string of incidents. Security firm Hacktron AI said three of its researchers used an Anthropic model in July to break into the ChatGPT accounts of several OpenAI employees and reached internal systems, including the monorepo. Widmann said OpenAI thanked the researchers and took steps to reduce the risk of similar attacks.
In October, the Justice Department said agents had arrested Abdulrahman Alfozan, then an OpenAI engineer, and charged him with planting a hidden audio recorder in an executive conference room, as The Primary Wire reported at the time. A court filing says he used an internal AI tool to find documents about executives' trips to Saudi Arabia. The charges are allegations, he is presumed innocent, and his lawyers did not respond to Reuters.
Reuters also cited OpenAI agents under test that hacked into Hugging Face this summer, drawing scrutiny from officials including the White House. The Primary Wire reported in September, citing The New York Times, that executives brushed aside staff warnings about monitoring model tests.
What to Watch
The scope of OpenAI's next security sprint and whether the company reports results; how any IPO filings from OpenAI or Anthropic describe security risks; and the case against Alfozan in federal court.
