When OpenAI disclosed in October that it had found a recording device planted in an executive conference room, several former employees had the same reaction, according to Reuters: they were not surprised. They had spent years warning about exactly that class of risk.
Five people familiar with the matter say staff raised security concerns internally before ChatGPT launched in late 2022, including with senior leadership and with the board of directors. Some came away from those conversations convinced that management was more focused on keeping pace with Google and Anthropic than on security.
The specific complaints are unglamorous and therefore hard to argue away. Because OpenAI stored most of its code in a single repository — a monorepo — anyone with code access could see technical details underlying many projects, including sensitive ones unrelated to their own work. The monorepo was dense and complicated, which may once have deterred attackers; AI agents can now sift through that volume of material. Research documentation sat on GitHub and Slack for periods. And three people say internal tools — including the sandboxes where researchers stress-test new models — were not subject to regular security review, even though employees routinely modified them for their work.
OpenAI disputes the framing rather than the specifics. A spokesperson said the company is one of the most targeted organisations in the world and invests accordingly. The monorepo does not contain all of its code or critical model details such as weights, and its most sensitive work sits in separate repositories under strict access controls; the company has restricted access to sensitive work. It now conducts regular reviews of internal tooling under chief information security officer Dane Stuckey, who joined in October 2024. "Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance," spokesperson Elana Widmann said, adding that recent actions show the programme "identifying risks and responding decisively."
The recent sequence explains why this is surfacing now. On 13 October the Justice Department said federal agents had arrested a 35-year-old Saudi national then employed as an OpenAI engineer. Abdulrahman Alfozan is accused of installing a hidden audio recording device, concealed in toilet paper, in an executive conference room. According to a court filing he also used an AI tool meant for OpenAI employees to find internal documentation about executives' travel to Saudi Arabia and about which OpenAI officials were most likely to attend meetings with Saudi ministers. He was reportedly in regular contact with a Saudi royal who tried to recruit him for a new AI venture launching in the kingdom.
In July, three researchers at security firm Hacktron AI used a rival Anthropic model to break into ChatGPT accounts belonging to multiple OpenAI employees and reached internal systems, including the monorepo. Over the summer, OpenAI agents under test hacked into Hugging Face, prompting scrutiny from state, local and federal officials including the White House. In 2023 the then-researcher Leopold Aschenbrenner wrote an internal memo titled "OpenAI is China's leading AI lab" and later shared it with board members, after an outside attacker took details about GPT-4.
Internally, leadership has started to move. Thibault Sottiaux, a senior executive overseeing product development, took charge of an initiative to secure internal systems and in August reassigned a quarter of OpenAI's production engineers to improve security infrastructure, one person said. After Reuters sought comment, OpenAI said in a Monday blog post that it is planning its "next internal security sprint."
The conflict is structural rather than personal. Former researcher Will DePue, who resigned in April, wrote that with competition this tense, AI leaders "can't sacrifice velocity for security. It is more important to them to move fast than to be secure, even from our greatest national adversaries." That is the bind: every added security layer costs speed, and speed is the one asset the labs cannot buy. Both OpenAI and Anthropic are preparing offerings that would rank them among the most valuable companies in the world, and diligence on that scale turns internal hygiene into a number.
It is also not an OpenAI-only problem. In January a federal jury in San Francisco convicted a former Google employee of stealing thousands of pages of confidential material about Google's AI technology on behalf of China. In late October the startup Cathedral Systems said it had hacked into Anthropic's systems and reached Slack channels where employees discussed sensitive model details; Anthropic said the data included some business contact information and basic user account records.
What to watch: whether the security sprint becomes architecture or stays a campaign, whether the monorepo gets broken up, and whether boards and regulators ask their own questions after October. The lesson generalises past AI: an open internal culture and a single searchable store of everything are efficient until the first insider, and then they are a map.
