That OpenAI fired three safety researchers has been known since early October. What led up to it has not. On 22 October the Wall Street Journal retraced the sequence, and at its centre sits a suspicion of leaked model internals.
The accusation
OpenAI’s security team called the three into separate meetings in September and asked them to unlock their personal phones. The company suspected them of passing information to an outside AI-safety researcher about one of its most closely guarded secrets: the internal designs of its own models. Per the Journal, the recipient was AI-safety researcher Ryan Greenblatt, and part of the communication ran through Signal chats set to delete themselves.
Officially OpenAI gives mishandling of sensitive information as the reason. The Journal frames that against a second fact: the three had been pushing to keep the workings of AI systems visible, and to let outsiders look.
What we already knew
Jasmine Wang, Tomek Korbak and Mikita Balesni pushed back in an open letter in early October, asking the company to preserve visibility into the models’ reasoning. At that point it was one account against another, with no named allegations. Now the allegations have names, from one side.
The Journal points to a run of its own reporting around the edges of this: AI firms playing cat and mouse with corporate spies, an OpenAI engineer and a microphone wrapped in toilet paper in a conference room. The body of the piece sits behind the paywall; what stands here is the part that can be sourced.
Trade secrets and auditability pull in opposite directions
This case exposes a conflict you cannot organise away. Independent review of AI systems needs access to exactly the things a lab treats as a trade secret. The deeper the access, the harder it gets to draw the line between reviewing and leaking.
The alternative turned up in the same week. METR and Redwood Research reviewed OpenAI’s monitoring system — chaperoned, on company devices that never left the building, with a 61-page report that will not be published. That is the domesticated route: supervised access, under contract. The undomesticated one apparently ends at unlocked private phones.