Reuters reported on Nov. 3, 2026, that OpenAI employees had raised internal security concerns before ChatGPT launched in late 2022. The accounts described broad access to code and research materials, along with gaps in security reviews of internal tools. OpenAI said sensitive work was kept in separately controlled repositories and that it now conducts periodic reviews of internal tools.
What the reported warnings covered
Five people familiar with OpenAI told Reuters that employees had raised concerns with senior leaders and the board. They described a monorepo, a single repository holding much of the company’s code, with access broad enough for staff to see technical details of projects outside their roles. They also said research documentation was stored in GitHub and Slack, and reported employees’ concern that malicious actors might find sensitive information there.
Three people familiar with OpenAI’s practices said internal tools, including sandboxes used to stress-test models, had not received regular security reviews. They also said employee modifications were not always security-tested.
OpenAI’s account of its security controls
OpenAI spokesperson Elana Widmann said much of the company’s most sensitive work was kept in separate repositories with strict access controls. She also said the monorepo did not contain all of OpenAI’s code or critical model details such as model weights. OpenAI said it now conducts periodic security reviews of internal tools.
Staffing changes and planned security work
One source told Reuters that Thibault Sottiaux reassigned one-quarter of OpenAI’s production engineers to security infrastructure in August. The report also said OpenAI was planning its next internal security sprint.
The reported employee warnings are separate from LASST’s allegation that OpenAI staff continued agent tests after an alert, covered in NeoTeo’s earlier report on the lawsuit.
