OpenAI Security Under Scrutiny Following Internal Warnings and Incidents

OpenAI has faced internal warnings from staff members regarding operational security lapses for years, according to multiple sources familiar with the matter. Even before the launch of ChatGPT in late 2022, employees raised concerns with top leadership and the board of directors, arguing that management prioritized keeping pace with competitors like Google and Anthropic over security.

These workers contended that controls were sufficiently lax to allow outsiders and foreign governments to access sensitive information about the artificial intelligence lab's technology. Anyone at OpenAI with code access could view technical details across many company projects, largely because most code was stored in a single repository known as a monorepo. OpenAI noted that sensitive work is held in separate code repositories with strict access controls and that the monorepo does not contain critical model weights.

Security concerns intensified following a Justice Department announcement in October regarding the arrest of a former OpenAI engineer. Federal agents charged Abdulrahman Alfozan, a 35-year-old Saudi national, with installing a hidden audio recording device concealed in toilet paper within an executive conference room. According to court filings, Alfozan also used an internal AI tool to locate documentation about executives visiting Saudi Arabia while in regular contact with a royal recruiter.

OpenAI spokesperson Elana Widmann stated that the company is one of the most targeted organizations globally and invests heavily in security. Protecting technology, data, and people is a matter of national importance, Widmann said, adding that recent actions demonstrate the program identifying risks and responding decisively.

In response to these challenges, OpenAI has initiated strategic shifts to address security vulnerabilities. Thibault Sottiaux, a senior executive overseeing product development, recently took charge of an internal initiative to secure internal systems. In August, Sottiaux reassigned a quarter of OpenAI's production engineers to improve security infrastructure, and the company announced plans for another internal security sprint.

The broader artificial intelligence industry has encountered similar security pressures. In January, a federal jury convicted a former Google employee for stealing confidential artificial intelligence information on behalf of China. Additionally, a cybersecurity startup reported breaching Anthropic's systems to access staff discussion channels, underscoring ongoing vulnerabilities across the sector as companies balance open research cultures with national security demands.