The quick read: • On Tue Nov 3, 2026, Reuters reported that OpenAI employees warned leaders about security weaknesses for years, including before ChatGPT launched in late 2022, citing five people familiar with the matter. • Workers argued controls were so lax that outsiders, including foreign governments, could obtain sensitive technical information with relative ease (Reuters). • Most of OpenAI's code sat in one repository, so anyone with access could see many unrelated projects, five sources said. Sources said AI agents can now sift through that material more easily than before (Reuters, The Next Web). • Three sources said internal tools, including the sandboxes used to stress-test new models, were not regularly security-checked (The Next Web). • The engineer charged in October with hiding a recording device in an executive conference room used an internal AI tool to find documents about executives' trips to Saudi Arabia, a court filing says (Reuters). He has not been convicted. • On Nov 2, OpenAI announced its next internal security sprint and a partnership with Cathedral, the startup that said it hacked into Anthropic's internal systems through Anthropic's bug bounty program in October (Gizmodo).
“OpenAI Staff Warned for Years Its Security Was Lax, Reuters Sources Say”
who’s making the noise
Reuters report, Tue Nov 3, 2026, citing five people familiar with the matter. Re-reported by The Next Web (Nov 4). OpenAI security sprint and Cathedral partnership announced Nov 2 (Gizmodo, Nov 3).
our take
OpenAI disputes parts of the account. It says its most sensitive work sits in separate, restricted repositories, the shared repository does not hold its model weights, and internal tools now get regular security reviews under security chief Dane Stuckey. Spokesperson Elana Widmann: "Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance." Two sources say a quarter of production engineers were moved to security work in August. But the sequence matters. The warnings came first, a hidden recorder came next, and the security sprint was announced after Reuters asked for comment. The fix arrived on the reporters' schedule, not the employees'. For a small business, the useful line is about the tools, not the spy story. The sources say AI agents now make it easier to sift through whatever an employee can reach. The same is true inside your company: an AI assistant connected to your shared drive can find everything that drive exposes. Check what your AI tools can open before someone else's does. What to watch: whether OpenAI publishes results from the Cathedral testing, and whether lawmakers follow the House Democrats' letter on whistleblower protections.