Fired OpenAI security researchers dispute allegations of misconduct, warn of chilling effect

Jasmine Wang, Tomek Korbak and Mikita Balesni, the three security researchers that OpenAI fired last week, released an open letter denying the company’s allegations that they mishandled sensitive information outside of the company’s established procedures and warned that their dismissals signaled a chilling effect that would impact the company’s culture.

“We became concerned that internal and external communications around our termination made our former colleagues afraid to speak and operate in ways that, until last week, were an integral part of working at OpenAI,” the researchers wrote Thursday in an open letter to OpenAI’s Safety and Security Committee, Security Advisory Group, and Mission Advisory Board.

The researchers were fired last week after allegedly sharing confidential company information with a third-party organization responsible for AI security. OpenAI said it violated company policies by “accessing and processing sensitive company information.”

“AI is not a normal technology, and OpenAI is not a normal company,” Wang, Korbak and Balesni wrote. “Those of us who work on security see the risks before anyone else, and we rely on working closely with external experts to determine how to address them. The freedom to do so without fear and having well-defined internal procedures that enable this work is itself an essential security mechanism.”

They said their firing represents a broader shift in OpenAI’s culture, which encouraged workers to “raise security concerns and openly disagree.” They said employees are now unclear where they stand, when behavior that was supposedly normal a month ago suddenly becomes grounds for termination.

“Given the significant security concerns surrounding AI development, employees should not be left to work in an environment where fear and unclear rules hinder AI security work and weaken third-party accountability,” they wrote. “Layoffs like ours, executed and communicated so abruptly, chill the open culture that OpenAI has valued in the past.”

In the letter, the three denied any involvement in a leak in The Information regarding less controllable architectures in OpenAI’s new models, which make chain-of-thought reasoning more difficult to monitor. They also denied collaborating with external parties outside the scope of their work.

OpenAI has not officially responded to the open letter, but shared with TechCrunch an internal memo attributed to a research leader, praising the three researchers’ contributions to AI safety and denying that they were fired in retaliation.

“I want to be very clear that these decisions were not intended to raise security concerns or speak out,” the memo reads. “We have always encouraged this and always will. We do not fire employees for raising concerns.”

Separately, an OpenAI spokesperson told TechCrunch that the three were fired after an investigation revealed a “pattern of misconduct” in “blatant violation of our policies for mishandling research information” that went beyond sharing information with an external AI review group.

OpenAI did not directly respond to TechCrunch’s questions about what policies the researchers allegedly violated, the circumstances of their dismissal, or how the company protects employees who raise security concerns and collaborate with external reviewers.

The layoffs have fueled speculation about their circumstances, especially as OpenAI faces increased scrutiny following recent security incidents involving malicious agents and leaks about its models.

The letter also addresses the researchers’ response to the Hugging Face incident, in which a swarm of agents broke out of their sandbox and breached external systems. The letter said the incident and investigation were “unprecedented,” meaning “internal policies were being developed in real time.” Due to the sensitive nature of the investigation, Korbak believed he was acting within OpenAI’s policies and standards by communicating closely with external security assessors to build trust, according to the letter.

At the same time, Balesni was also working internally to address the growing problem of AI surveillance, an effort that the researchers say in their letter “can only succeed through extensive communication with external parties.” According to the letter, Balesni coordinated and was supported by OpenAI board members and leadership throughout his work.

“Throughout, Mikita checked with his management and was careful to remove sensitive details from the documents before sharing them,” the letter said. “He acted in good faith and in accordance with the standards of the company as they existed at the time.”

In a separate thread on X, Wang explained more details about her own firing, explaining that OpenAI told her she was fired because she accessed an executive’s email.

“OpenAI has delegated this access to me for recruitment,” she wrote. “When I no longer needed it, I asked IT to delete it. They didn’t follow up on my request, I couldn’t delete it myself, and the inbox was combined indistinguishably in my phone’s email app. When I opened a sensitive email by mistake, I informed the manager within minutes and asked IT again. None of this was hidden.”

Wang went on to say that the reasons behind the layoffs “don’t add up” and that she and her colleagues are “not the first to be kicked out of OpenAI under suspicious circumstances.”

The researchers called on OpenAI to uphold its public commitments to integrate third-party security auditors within the organization, preserve monitoring of boundary models, and “continue to support a culture of open and transparent dialogue between security researchers and the rest of the security ecosystem.”

OpenAI agrees with their recommendations, according to the memo.

“Unless employees take a stand now against this kind of maneuver, I fear we will not be the last,” Wang said. “The message to everyone still working at OpenAI is clear: raise concerns or work closely with external security groups, and you could be next, without being told why. You can’t build AGIs safely if the people closest to the risks are afraid to speak up.”

This article has been updated with more information from OpenAI.