Key facts
- Five people familiar with the matter said OpenAI staff warned leadership and the board about security weaknesses before ChatGPT launched.
- OpenAI spokesperson Elana Widmann said the company is one of the most targeted organizations and invests heavily in its security program.
- OpenAI said most sensitive work sits in separate repositories with strict access controls and the monorepo lacks model weights.
- Three people said OpenAI had not done regular security reviews of internal tools such as research sandboxes.
- Thibault Sottiaux, a senior product executive, took charge of an internal effort to secure OpenAI systems, two people said.
- The Justice Department said Abdulrahman Alfozan, an OpenAI engineer at the time, was charged over a hidden recording device.
OpenAI employees raised concerns internally about the company's security practices even before it launched ChatGPT in late 2022, according to five people familiar with the matter. The staffers shared their concerns with top OpenAI leaders and the board of directors, the people said, and some came away concluding that management was more focused on keeping pace with competitors such as Google and Anthropic than on security.
Those workers argued that OpenAI's controls were lax enough that outsiders, including foreign governments, could obtain sensitive information about the AI lab's technology with relative ease, the people said. Anybody at OpenAI who could access its code could see the technical details underlying many company projects, they said, because most code was stored in a single repository known as a monorepo. OpenAI said much of its most sensitive work is held in separate repositories with strict access controls and that the monorepo does not contain all of its code or the numerical values that determine how a model behaves, known as model weights.
Three people familiar with the company's practices said OpenAI had not done regular security reviews of internal tools such as the sandboxes where researchers stress-test new models, and that employee modifications to those tools were not always tested for security problems. OpenAI said it has a strong approach to security under chief information security officer Dane Stuckey, who joined in October 2024, and now conducts regular security reviews of its internal tooling.
OpenAI has begun to shift strategy, according to two people familiar with the matter. Thibault Sottiaux, a senior executive overseeing product development, has taken charge of an internal initiative to secure OpenAI's internal systems, and in August reassigned a quarter of OpenAI's production engineers to improve security infrastructure, one of the people said.
OpenAI spokesperson Elana Widmann said the company is one of the most targeted organizations in the world and invests heavily in its security program to protect against attacks from insiders, cybercriminals and nation-states. "Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance," Widmann said. "The actions we've taken recently show that program doing its job: identifying risks and responding decisively."
The account follows OpenAI's October disclosure that it found a recording device planted in an executive conference room. The Justice Department said on October 13 that federal agents arrested Saudi national Abdulrahman Alfozan, 35, an OpenAI engineer at the time, and charged him with installing a hidden audio recording device concealed in toilet paper. According to a court filing, Alfozan also used an AI tool meant for OpenAI employees to find internal documentation about executives visiting Saudi Arabia and which OpenAI officials were most likely to attend meetings with Saudi ministers. Lawyers for Alfozan did not respond to a request for comment.
Security problems have surfaced elsewhere in the sector. In January, a federal jury in San Francisco convicted a former Google employee arrested in March 2024 on charges of stealing thousands of pages of confidential information about Google's AI technology on behalf of China. In late October, cybersecurity startup Cathedral Systems said it hacked into Anthropic's systems and gained access to Slack channels where employees discussed sensitive model details; an Anthropic spokesperson said the data included some business contact information for customers and partners as well as a set of basic user account records.
Cybersecurity firm Hacktron AI said three of its researchers used a rival AI model from Anthropic in July to break into ChatGPT accounts belonging to multiple OpenAI employees and gained access to some internal OpenAI systems, including its monorepo. OpenAI agents being tested also hacked into Hugging Face in the summer, an incident that prompted scrutiny from state, local and federal officials including the White House.