55
OpenAI faced repeated internal warnings about weaknesses in its security practices years before recent incidents brought its safeguards under
scrutiny, according to a Reuters report published on November 3, 2026.
Five people familiar with the company's operations told Reuters that employees had raised concerns with senior executives and board members even before ChatGPT was launched in late 2022.
One major concern involved access to OpenAI's internal code repository. Employees reportedly warned that staff members with repository access could view technical information about projects beyond their immediate responsibilities. Much of the company's code was reportedly stored in a single repository, known as a monorepo. Researchers also raised concerns about sensitive documentation being shared through platforms such as GitHub and Slack.
Another concern involved internal testing environments used by researchers to evaluate AI models. Three people familiar with the company's practices told Reuters that these tools did not always undergo regular security assessments after changes were made, potentially leaving vulnerabilities undetected.
The company's security practices came under further scrutiny following the October arrest of OpenAI engineer Abdulrahman Alfozan. US authorities charged him with allegedly installing a concealed recording device in an executive conference room. A court filing also alleged that he used an internal AI tool to search for information about executives' visits to Saudi Arabia.
OpenAI said it had no indication that the engineer improperly accessed or extracted model weights, source code or customer data.
Responding to the concerns, OpenAI said its most sensitive research is stored in separate repositories with strict access controls. The company also said it conducts regular security reviews of internal tools and invests heavily in protecting its technology and employees.
Reuters further reported that senior executive Thibault Sottiaux took charge of an internal security initiative. In August, he reportedly reassigned a quarter of OpenAI's production engineers to strengthen the company's security infrastructure, according to one source.
The disclosures highlight the growing security challenges facing AI companies as they develop increasingly valuable technologies. They also raise questions about how organisations can protect sensitive research, control internal access and address security concerns while rapidly expanding their AI capabilities.
Five people familiar with the company's operations told Reuters that employees had raised concerns with senior executives and board members even before ChatGPT was launched in late 2022.
One major concern involved access to OpenAI's internal code repository. Employees reportedly warned that staff members with repository access could view technical information about projects beyond their immediate responsibilities. Much of the company's code was reportedly stored in a single repository, known as a monorepo. Researchers also raised concerns about sensitive documentation being shared through platforms such as GitHub and Slack.
Another concern involved internal testing environments used by researchers to evaluate AI models. Three people familiar with the company's practices told Reuters that these tools did not always undergo regular security assessments after changes were made, potentially leaving vulnerabilities undetected.
The company's security practices came under further scrutiny following the October arrest of OpenAI engineer Abdulrahman Alfozan. US authorities charged him with allegedly installing a concealed recording device in an executive conference room. A court filing also alleged that he used an internal AI tool to search for information about executives' visits to Saudi Arabia.
OpenAI said it had no indication that the engineer improperly accessed or extracted model weights, source code or customer data.
Responding to the concerns, OpenAI said its most sensitive research is stored in separate repositories with strict access controls. The company also said it conducts regular security reviews of internal tools and invests heavily in protecting its technology and employees.
Reuters further reported that senior executive Thibault Sottiaux took charge of an internal security initiative. In August, he reportedly reassigned a quarter of OpenAI's production engineers to strengthen the company's security infrastructure, according to one source.
The disclosures highlight the growing security challenges facing AI companies as they develop increasingly valuable technologies. They also raise questions about how organisations can protect sensitive research, control internal access and address security concerns while rapidly expanding their AI capabilities.
