OpenAI Employees Raised Security Concerns for Years Ahead of Incidents
Former OpenAI staff warn that management prioritized speed over security, leaving sensitive tech vulnerable to foreign and insider threats.
Long before OpenAI reported finding a hidden recording device in an executive conference room this October, multiple former staff members had voiced internal concerns regarding the organization's security protocols. Interviews with five individuals familiar with the matter reveal that warnings about lax defenses were shared with top leadership and the board of directors prior to the late 2022 release of ChatGPT.
According to these sources, some employees felt management prioritized keeping pace with rivals like Google and Anthropic over establishing robust security controls. Staff members argued that outsiders, including foreign governments, could potentially access sensitive technical information with relative ease. For example, anyone with access to OpenAI's code could view technical details across many projects because the company stored most of its code in a single repository, or "monorepo." Furthermore, research documentation was often kept on GitHub and Slack.
Management Response and Recent Adjustments
OpenAI has begun modifying its strategy to address these operational vulnerabilities. Thibault Sottiaux, a senior product development executive known as "Tibo," took charge of an internal security initiative. In August, Sottiaux reassigned a quarter of OpenAI's production engineers to upgrade the company's security infrastructure. Additionally, under Chief Information Security Officer Dane Stuckey, who joined in October 2024, the company now conducts regular security reviews of internal tools.
An OpenAI spokesperson, Elana Widmann, stated that the organization is one of the most heavily targeted entities globally and invests significantly in security to protect against insiders, cybercriminals, and nation-states. Widmann emphasized that recent actions demonstrate the security program identifying risks and responding decisively. The company also noted that it has restricted access to sensitive work, that critical model weights are kept separate from the monorepo, and that it plans an upcoming internal security sprint.
Incidents and Industry-Wide Vulnerabilities
Security concerns gained public attention following specific events. In October, the Justice Department announced the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, charged with planting a recording device disguised in toilet paper inside an executive conference room. Court filings stated Alfozan also used an internal AI tool to search for documentation concerning executive travel to Saudi Arabia.
Other incidents include an external hack in 2023 that accessed details about GPT-4 through company-wide Slack channels, and a July incident where cybersecurity firm Hacktron AI used an Anthropic model to breach ChatGPT accounts and access internal systems. Additionally, former researcher Leopold Aschenbrenner circulated a 2023 memo warning that China could infiltrate the lab, while Will DePue, a former researcher who resigned in April, posted on X that leaders prioritized velocity over security against national adversaries.
Security challenges extend across the sector. A former Google employee was convicted in San Francisco for stealing confidential AI technology data on behalf of China, and cybersecurity startup Cathedral Systems reported accessing Slack channels at Anthropic containing business contact information and user account records.
What it means for developers
As major AI labs face mounting scrutiny over internal security, code repositories, and research access, the tension between maintaining an open, collaborative academic culture and protecting vital intellectual property continues to grow. Developers who rely on cutting-edge systems can try top AI models cheaply through one API at https://apixoai.online, providing an alternative way to access tools from Claude, GPT, Gemini, Grok, and DeepSeek via a single key while these broader industry security dynamics unfold.
Source: OpenAI employees warned about operational security lapses for years — Indian Express AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
