OpenAI’s security team called three outspoken safety researchers into meetings last month and asked them to unlock their personal phones.
A week later, the three were summoned again to simultaneous 2 p.m. meetings—and fired. OpenAI rolled out a new type of AI in late 2024 called a reasoning model. Because it took time to work through problems, writing out its reasoning process on an internal scratchpad called a “chain-of-thought, it performed better at math and coding.
Tech leaders are pushing for model breakthroughs, but a string of unauthorized actions taken by clusters of AI agents—stretching back to July’s hack on Hugging Face —has revealed challenges the companies face in understanding and controlling their creations. Within weeks, an OpenAI official announced internally that the company was launching an investigation into the leak. She says she didn’t share its contents with others and immediately reported the incident.
“I was told that there was a breach of trust because I interacted with a third party through unsanctioned channels,” said Tomek Korbak, one of the fired researchers. OpenAI told The Wall Street Journal that it fired the three researchers after an internal investigation found they violated “clear policies for handling sensitive information,” and “not for raising safety concerns or speaking out. Anthropic last week announced a deal to give staffers from AI safety nonprofit METR “employee-like access” to the company’s systems including hardware, office space, internal tools and systems. The company said employees should share information with METR, except for categories including “model architectures,” which it said have a high risk of leaking. METR said OpenAI redacted some of the findings it could share. Balesni said OpenAI’s investigators named Greenblatt as the suspected leaker, and asked to see their Signal chats with him. The OpenAI spokeswoman said using Signal wasn’t approved, but its use wasn’t the sole reason for the firings. Korbak said using disappearing messages on Signal is considered a “basic security best practice” throughout Silicon Valley. “I take confidentiality very seriously and never share such information with reporters,” he told the Journal. Both Redwood and METR, which has since hired Greenblatt, said they take confidentiality seriously. Wang was told she was fired for repeatedly accessing an executive’s email, she said in a statement. Wang said she asked the company to remove her access nearly a year ago, but they didn’t, and she mistakenly opened a sensitive email last month that was addressed to this executive. The OpenAI spokeswoman said the company didn’t have a problem with the access itself. “We are hearing from our colleagues that they are afraid to talk to third parties now, and are afraid of raising safety concerns,” said Korbak, who wants companies to develop clear rules for how staff can interact with auditors.
The company suspected the three of leaking information to an external AI-safety researcher about one of OpenAI’s most closely guarded secrets: the internal designs of its artificial-intelligence models. When security officers examined the phones, they saw some of the researchers had turned on disappearing messages for their chats with the person on the app Signal. The firings came in the throes of a battle over how to keep AI systems under human control—and who gets to see the secret designs that could determine the winners of the biggest commercial race in history. That has ignited a societal debate over how best to monitor and regulate the new technology. It represented a shift from the models powering early versions of ChatGPT, which produced answers almost instantly. That is when Balesni, Korbak, and Wang, among others, were pulled into meetings with the company’s global security investigations team. Balesni and Korbak say OpenAI leaders cited their use of disappearing messages as a reason for their terminations. All three researchers claim they have never shared OpenAI’s confidential information with anyone outside the company. Greenblatt denies he was the source of any leaks of confidential information to The Information. Balesni, Korbak, and Wang, in an October letter to OpenAI’s board, urged the company to work with external safety organizations to help stave off the “risk that something truly catastrophic will happen. Write to Maxwell Zeff at [email protected] , Keach Hagey at [email protected] and Berber Jin at [email protected]
On Thursday, OpenAI said it ran a pilot embedding researchers from METR and Redwood Research, another nonprofit, to assess its safety systems.
Other co-authors on the paper included Wang, 28, as well as leaders from OpenAI, Anthropic, Google DeepMind, and Meta. 1, tech news site The Information published a story that claimed OpenAI’s latest model, Astra, employed a new technique that made it more powerful, but revealed less of its thinking. Over the summer, Wang and other staff at major AI developers had also signed a letter calling for an international effort to slow down AI development so that safety research could keep up.
“We all felt like this is a happy coincidence that we want to hang onto,” said Joshua Saxe, a former AI security tech lead at Meta Platforms. In 2025, before they joined OpenAI, Balesni, 27 years old, and Korbak, 32, were co-leads on a paper saying that monitoring a model’s chain-of-thought offered a “rare glimpse into how AI agents make decisions” that should be preserved. “One thing that AI companies could do that would severely hamper that is make the AIs much better at thinking inside their heads,” Balesni said. Balesni said he shared it with colleagues and discussed it with a board member and a senior executive at the company. Balesni said he also shared the proposal, stripped of company secrets, with Greenblatt after receiving authorization from OpenAI to speak with him about it. The scope of METR’s work was at times a point of friction internally, according to people familiar with the matter. Mia Glaese, vice president of research and safety, wanted to ensure that third party groups wouldn’t be able to view OpenAI’s intellectual property, OpenAI said. Korbak said he raised concerns internally that METR wouldn’t get enough access. Korbak said he communicated with Greenblatt through OpenAI’s internal Slack, as well as on Signal. Jacob Coxon, then an Anthropic researcher, called it “a bit of a ‘holy s—’ moment” for him. After Coxon’s resignation, the concept of “pacing” cutting-edge AI research was endorsed by AI leaders including Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman. “My overriding concern is that AI development is moving too fast,” Wang said in a statement. OpenAI’s Pachocki called the reporting “confused” in a post on X, but raised his own concerns about kick-starting an industrywide race into developing AI models that can’t be monitored.
Widely adopted in the industry, the feature offered clues about how modern AI models work. This summer, some AI-company workers discussed efforts to develop new, more opaque models that could reason longer, without writing down as many interim steps. Ryan Greenblatt, then chief scientist at Redwood Research, drafted a proposal for companies to avoid such a change. Balesni sent a link to the proposal in an OpenAI Slack channel that included two dozen staffers, including Chief Scientist Jakub Pachocki. By August, Balesni and others at OpenAI wrote a proposal similar to Greenblatt’s, arguing that companies should agree not to pursue AI designs that prevent humans from seeing a model’s internal scratchpad. OpenAI researchers used those scratchpads to investigate an incident in which hundreds of its agents worked together to hack Hugging Face While Balesni fought to ensure that future AI models would continue to keep a scratchpad of their work. OpenAI leaders also agreed to work with METR, the outside safety group, to investigate the Hugging Face incident. OpenAI ultimately allowed METR to conduct a limited inquiry and named Korbak to the collaboration team. METR contracted Greenblatt, who had publicly urged an investigation, to help parse the logs. METR’s report on how OpenAI’s agents had gone rogue laid the groundwork for the first great national panic over AI safety. Days later, Coxon resigned publicly with a viral warning that some AI researchers believed their products had a meaningful chance of wiping out humanity. On Sept.
In an interview and a statement, the three said they never received a written explanation for what sensitive information they allegedly mishandled, and spent their final months at the company pushing for more industry collaboration on safety. In particular, the fired researchers said they had raised concerns inside OpenAI about potential new AI designs, or “architectures,” that could accelerate capabilities, but make the systems even harder to understand or control. They said they were worried their firing will serve as an excuse for OpenAI to close a channel to independent third-party oversight. An OpenAI spokeswoman said the company already works with third-party safety organizations and “will be announcing ongoing collaborations with several companies imminently. OpenAI research leaders have said they agree with the fired workers that “preserving the monitorability of frontier models requires an industrywide commitment, including from OpenAI.
The researchers—Korbak, Mikita Balesni and Jasmine Wang—dispute that account. Other AI labs are also wrestling with how much to share with outside safety researchers.
