OpenAI Probed Safety Researchers’ Signal Messaging Before Firings

OpenAI, a company that develops AI, examined the personal phones of safety researchers as part of an investigation into leaked information before firing three employees, according to a Wall Street Journal report. Two researchers say that conversations with an outside AI safety expert on Signal, an app with disappearing messages, were used as a reason to fire them. They say these conversations were part of their jobs. The dispute raises questions about what counts as sharing company secrets.

The employees, Tomek Korbak, Mikita Balesni and Jasmine Wang, deny sharing confidential information. OpenAI says its investigation found that they broke rules for handling sensitive information. The company also says they were not fired for raising safety concerns. An OpenAI spokeswoman told the Journal that Signal was not an approved app for this work, but that using it was not the only reason for the firings.

The Messages and the Leak Investigation

According to the Journal, security staff asked the three employees to unlock their phones in September. Some had turned on disappearing messages in chats with Ryan Greenblatt, an outside AI safety researcher who was then the chief scientist at Redwood Research. A week later, all three were fired in meetings held at the same time.

The Journal says the leak investigation began after The Information published a story on September 1 about the design of Astra, an OpenAI model. The story said a new method made the model more powerful while showing less of how it reached its answers. OpenAI chief scientist Jakub Pachocki called the report confused, according to the Journal. Within weeks of the story, an OpenAI official announced an internal investigation into leaks.

I want to prevent a race into making AI systems harder to monitor, sparked by confused reporting. The amount of computation in our current most advanced models, including Astra, is within a factor of two of GPT-4.

OpenAI has worked to preserve and use chain-of-thought monitoring since…

— Jakub Pachocki (@merettm) September 2, 2026

The Journal reports that OpenAI suspected the three employees of leaking internal information about model design to an outside safety researcher. Balesni says investigators named Greenblatt as the suspected source and asked to inspect their Signal messages. He and Korbak say company leaders pointed to the disappearing messages when explaining their dismissals. Korbak says he was told that his contacts with people outside the company used unapproved channels. He says he considered disappearing messages a normal way to protect security.

Greenblatt denied being the source of confidential information leaked to The Information. The three former employees say OpenAI did not give them a written explanation naming the sensitive information they were accused of mishandling. In an earlier response to TechCrunch on October 8, OpenAI said the alleged misconduct was part of a wider pattern and went beyond sharing information with an outside evaluation group.

Last week, I was called into a meeting with OpenAI's head of safety and told that they no longer trusted me. A security guard took my badge and escorted me out of the building. Then I learned that my colleagues @balesni and @j_asminewang had also been fired. Why did OpenAI suddenly stop trusting… https://t.co/DttJjXKGcp

— Tomek Korbak (@tomekkorbak) October 8, 2026

The Safety Work Behind the Conversations

OpenAI assigned Korbak to work with METR, a nonprofit group that studies AI risks, on an investigation into a recent intrusion into the AI platform Hugging Face. METR hired Greenblatt to help study the incident logs. Korbak says they used both OpenAI's Slack and Signal to communicate.

OpenAI says its vice president of research and safety, Mia Glaese, wanted to protect the company's intellectual property. Korbak says he was concerned that METR would not get enough access to investigate the incident. In their letter to OpenAI's board, published on October 8, the researchers say close contact with outside experts was needed to build trust. They describe an unusual investigation in which the rules for working together were still being developed.

METR and Redwood's evaluators spent six days working at OpenAI's offices and received extra visits and datasets, according to their joint report. But they could not directly access infrastructure data or send queries to the main model. There was a great deal of material to review and little time, so they relied heavily on AI tools to analyze it. This made their findings harder to check and left them less confident than they would have been in a simpler investigation. They also said AI tools made it possible to finish the work within the time available.

Balesni's outside conversations were about a different project. He wanted AI companies to keep models' intermediate reasoning available for inspection. Reasoning models can write out steps before giving an answer or taking an action. An automated monitor can read this text along with other information and look for signs of unsafe behavior. If it spots a concern, the system can block the action, replace it or examine it more closely.

The researchers' 2025 paper explaining their position describes how AI designs that do more reasoning internally, without writing down the steps, could hide information that these monitors need. A written explanation does not show everything happening inside a model, but it can give safety systems another way to spot problems.

Greenblatt wrote a proposal asking companies to avoid designs that show fewer reasoning steps. By August, Balesni and his colleagues had developed a similar proposal within OpenAI. Balesni says he discussed it with a board member and a senior executive, received permission to discuss it with Greenblatt, and shared a version that removed company secrets.

The researchers deny providing information for The Information's story. In their letter, they argue that the story weakened efforts to get AI companies to agree to limits on designs that make models harder to monitor.

The same paper also says that directly supervising a model's reasoning might improve how well it follows its intended behavior. That improvement could be worth losing some ability to monitor its reasoning.

My former colleagues tell me they are confused about what to believe. They are also afraid to speak and worry that their personal phones will be searched for messages with us and other people outside the company. I worry that the widespread fear of speaking up and working with outside experts will mean OpenAI…

— Mikita Balesni (@balesni) October 8, 2026

Wang Describes a Separate Inbox Dispute

Wang says OpenAI told her she was fired for repeatedly opening an executive's email. She says she had been given access to the inbox to help with recruiting, but that access remained active for almost a year after she asked the IT team to remove it.

Wang says she could not remove the access herself, and the combined inbox on her phone did not clearly show which account each message was meant for. She says she accidentally opened a sensitive email, told the executive within minutes and asked IT again to remove her access. An OpenAI spokeswoman told the Journal that the company did not consider the access itself to be a problem.

OpenAI fired me last week, along with two of my colleagues who worked on safety. I was given one reason: that I had accessed an executive's email. I want to explain this clearly, because too much of OpenAI's history is hidden behind smoke and mirrors when people disappear: https://t.co/RC4fm2nV95

— Jasmine Wang (@j_asminewang) October 8, 2026

Outside Access Comes With Information Limits

Adam Gleave, head of the AI safety group FAR.AI, said outside evaluators could compare models at different stages of training to find out when troubling behavior first appeared. Logs and interviews with employees could also help them check whether a company's public claims about safety matched what it did internally. Gleave said FAR.AI had turned down contracts that gave AI developers too much control over evaluations.

In a separate project from the Hugging Face investigation, one METR researcher and one Redwood researcher tested OpenAI's internal monitoring system from July 21 to August 11. METR's October 22 report says they could access internal code, monitoring settings and documents. They also interviewed about a dozen researchers and engineers. METR says OpenAI's access and support greatly helped the work.

However, the rules for publishing the results were more limited than the technical access. The participants agreed to publish only a short, general report. OpenAI could remove information it considered sensitive, and the evaluators could not independently describe what had been removed.

Anthropic's access rules, published on October 15 and clarified on October 16, cover six METR employees who work inside the company. They can use internal tools and systems similar to those used by Anthropic's own risk assessment teams. Staff are encouraged to share information with them, but there are specific exceptions, including the internal designs, or architectures, of AI models. Sharing important details about model architecture generally requires clear approval from inside the company.

Under this arrangement, Anthropic cannot block an entire report from being published. However, it can require information to be removed from certain predefined categories and decides which information belongs in those categories. METR can describe how much access it received and what kinds of information it was given.

The researchers who were fired are asking OpenAI to set clear rules for how employees can communicate with outside auditors. Korbak says colleagues have told him they are afraid to have these conversations or raise safety concerns.