OpenAI employees warned about operational security lapses for years, sources say

Key Points:

• OpenAI faced internal security concerns even before launching ChatGPT, with employees warning that lax controls could allow outsiders, including foreign governments, to access sensitive information easily.
• The company has recently shifted focus to improve security, reassigning engineers and initiating internal projects under senior executive Thibault Sottiaux to strengthen protections against insider threats and cyberattacks.
• A significant breach involved a former OpenAI engineer, Abdulrahman Alfozan, who was arrested for planting a recording device and allegedly sharing internal information with Saudi contacts, highlighting real risks from insider threats.
• OpenAI’s open research culture and use of a single monolithic code repository (monorepo) have contributed to security vulnerabilities, although the company states that critical model details and sensitive work are stored separately with stricter access controls.
• The tension between rapid AI development and robust security remains a challenge, as adding protective layers can slow innovation and impact company valuations, but OpenAI plans ongoing security enhancements to address evolving threats.