Behind OpenAI's “eavesdropping doors”: Employees say warnings have not been heeded for many years, and the conflict between safety and speed is highlighted

The Zhitong Finance App learned that when OpenAI revealed in October that it had discovered a recording device in an executive conference room, many former employees reacted unanimously — they were not surprised. According to five people familiar with the matter, long before OpenAI launched ChatGPT at the end of 2022, some employees had raised internal concerns about its security measures. According to these sources, employees have expressed concerns to OpenAI's senior management and board of directors, and after communicating with management, some employees have come to the conclusion that management is more concerned about keeping up with competitors such as Google (GOOGL.US) and Anthropic rather than security issues.

These employees believe that OpenAI's controls are too lax, and that outsiders can obtain technologically sensitive information about this AI lab relatively easily. For example, anyone within the company who has access to the code can see the underlying technical details of many projects.

According to two people familiar with the matter, OpenAI has begun to adjust its strategy to deal with security issues. Thibault Sottiaux, a senior executive responsible for product development, recently took over an internal initiative to protect OpenAI's internal systems. A person familiar with the matter said that in August of this year, Sottiaux redeployed a quarter of OpenAI's production engineers to improve security infrastructure.

These internal warnings — including employees reporting internal flaws to leadership over the years, some details of which were not previously disclosed — highlight the tense relationship in the AI space. Since ChatGPT was launched at the end of 2022, AI technology has become a strategic asset for the US, prompting US companies to face pressure to protect the technology from foreign competitors.

However, the combination of security measures may also slow the advancement of AI technology and may complicate large-scale initial public offering (IPO) plans of OpenAI and Anthropic. If these two companies go public, they will rank among the companies with the highest market capitalization in the world.

Will Depue, a former researcher who resigned from OpenAI in April of this year, wrote in a post on X that AI leaders “cannot sacrifice speed for safety in the face of such intense competition. For them, moving fast is more important than ensuring safety, even if the opponent is our strongest national opponent.”

When asked about employees' concerns and their belief that management has not acted on these issues, OpenAI spokeswoman Elana Widmann said OpenAI is one of the most attacked organizations in the world. As a result, the company invests significant resources in security programs to prevent attacks by insiders, cybercriminals, and nation states.

“Protecting our technology, data, and people is a responsibility we take seriously, and it's a matter of national interest,” Widmann said. “Our recent actions show that this safety system is working: identifying risks and responding decisively. We will continue to strengthen our defenses as technology and threats evolve.”

Recording Equipment Incidents and Codebase Concerns

On October 13, the US Department of Justice said that federal agents arrested a Saudi man, accusing him of installing hidden recording equipment in an executive conference room. The equipment was hidden in toilet paper. Abdulrahman Alfozan, 35, was an OpenAI engineer at the time.

Alfozan also used an AI tool for OpenAI employees to find internal documents about executives visiting Saudi Arabia and which OpenAI officials are most likely to attend meetings with Saudi ministers, according to a court document. Alfozan is in regular contact with a member of the Saudi royal family who is trying to recruit him to participate in a new AI project to be launched in Saudi Arabia. Alfozan's attorneys did not respond to requests for comment.

According to five people familiar with the matter, some employees have long been worried that OpenAI's internal information will be widely available.

According to these sources, anyone with access to the OpenAI code can see the details of many of the company's projects, including sensitive projects unrelated to the employee's job. This is because OpenAI stores most of the code in a single codebase, known as a “monorepo” in the industry. The codebase is large and complex, and may have deterred some potential attackers in the past. Today, AI agents can screen such a large amount of material.

Five people familiar with the matter said that in the past, OpenAI stored many research documents on GitHub and Slack, which raised concerns among some employees: purposeful attackers may still find critical information. But one of the sources and OpenAI said the company has restricted access to sensitive jobs.

OpenAI emphasizes that its most sensitive work is housed in a separate codebase with strict access controls. The company also stated that monorepo does not include all of its code or key details of the company's model, including the numerical values that determine the model's behavior, that is, model weights.

Another problem is that, according to three people familiar with the matter, OpenAI does not conduct regular security reviews of internal tools, such as the “sandbox” that researchers use to stress test new models. The three sources said that employees often modify these tools due to work needs, but the relevant changes are not always tested for security, making them vulnerable to external attacks.

OpenAI said that under the leadership of Chief Information Security Officer Dane Stuckey, who took office in October 2024, the company has taken strong security measures. According to OpenAI, internal tools are now regularly reviewed for security.

The dilemma of safety and speed

OpenAI isn't the only AI company facing security issues.

In January of this year, a federal jury in San Francisco found a former Google employee guilty. This person was arrested in March 2024 and charged with stealing thousands of pages of confidential information about Google's AI technology.

At the end of October, cybersecurity startup Cathedral Systems said it had broken into the Anthropic system and visited the Slack channel where employees discussed details of sensitive models. An Anthropic spokesperson said the accessed data included some business contact information for customers and partners, as well as a set of basic user account records. Cathedral's CEO did not respond to requests for comment.

OpenAI and Anthropic seek to maintain a more open culture of research to attract talent and inspire creativity that can lead to breakthroughs. The field of AI is rooted in academia, and machine learning scientists used to publicly discuss research in an academic environment.

According to five people familiar with the matter, as AI capabilities increase, some OpenAI employees are increasingly concerned about this approach.

Security concerns within OpenAI heated up again this summer: the AI agent OpenAI is testing hacked into the AI company Hugging Face. The incident triggered scrutiny by state, local, and federal officials, and the White House was also among them.

Cybersecurity company Hacktron AI said that in July, three of its researchers used an Anthropic competitive AI model to hack into the ChatGPT accounts of several OpenAI employees and accessed some of OpenAI's internal systems, including its monorepo. The incident revealed that advanced AI can now also expose AI companies themselves to the risk of attacks.

OpenAI's Widmann said the company thanks the researchers for sharing the findings and has taken steps to reduce the risk of similar attacks in the future.

OpenAI said in a blog post on Monday that it plans to launch the “next internal security sprint” to strengthen defenses.