OpenAI Staff Flagged Code Exposure for Years, Sources Say

OpenAI workers warned company leaders for years that anyone at OpenAI who could access its computer code could also see technical details about many of its projects. Reuters reported this on 3 November, based on information from five people who knew about the situation. They said the problem was that OpenAI kept most of its code in one large storage place called a 'monorepo'.

Reuters also reported that, according to one person, a senior leader moved one-quarter of OpenAI's production engineers to work on security systems in August. OpenAI's own post from 2 November said that 25% of its product engineers worked on security during its last focused security effort, called a sprint. Of the four OpenAI security incidents Reuters gave dates for, we counted three that happened in 2026, starting this summer.

What Reuters Reported

Five people told Reuters that some OpenAI workers were worried about the company's security even before ChatGPT launched in late 2022. They said workers shared their concerns with OpenAI's top leaders and board. Some workers felt that company leaders cared more about keeping up with Google and Anthropic than about security.

According to these people, the workers believed OpenAI's security rules were too weak. They worried that outsiders, including foreign governments, could get sensitive information about OpenAI's technology fairly easily. Reuters said some details about these internal warnings had not been reported before.

The people said that anyone with access to OpenAI's code could also see information about many projects, including sensitive projects that had nothing to do with their jobs. Reuters said the monorepo contained so much complicated material that it may have discouraged some attackers in the past. But AI agents can now search through large amounts of code and information.

Three people also told Reuters that OpenAI had not regularly checked the security of some tools used inside the company. These included sandboxes, which are special testing spaces where researchers push new AI models to see how they behave under difficult conditions. Workers often changed these tools, and the changes were not always checked for security problems, the three people said.

What OpenAI Says

OpenAI told Reuters that much of its most sensitive work is kept in separate code storage places with strict rules about who can access them. The company said the monorepo does not hold all of its code or important details about its AI models, including the model weights. OpenAI said it has a strong security program led by chief information security officer Dane Stuckey, who joined the company in October 2024. It also said it now regularly checks the security of its internal tools.

OpenAI spokesperson Elana Widmann told Reuters that OpenAI is one of the organizations most often targeted by attackers worldwide and that it spends heavily on security. She said protecting the company's technology, information, and people is something OpenAI takes very seriously and considers important to national security. She also said the company's recent actions show that its security program is working because it finds risks and takes strong action to deal with them.

Reuters reported that after it asked OpenAI for a comment, the company said in a blog post that it was planning its next internal security sprint.

One-Quarter of the Engineers

Two people told Reuters that Thibault Sottiaux, a senior leader responsible for product development, had recently taken charge of a project to make OpenAI's internal systems safer. One person said Sottiaux moved one-quarter of OpenAI's production engineers to work on improving its security systems in August.

In its 2 November post, OpenAI said it had assigned 25% of its product engineers to find and fix weak points in its systems during its last security sprint. The company said researchers from Cathedral would join OpenAI's own teams for the next sprint. The post did not mention the monorepo, Sottiaux, or when the previous sprint took place. So the idea that Reuters and OpenAI were talking about the same change is our interpretation. Neither source directly confirmed that.

What OpenAI Says About Its Monorepo

On 2 November, OpenAI also published an engineering post about Pando, the system it uses to manage Git code storage. The post described the same monorepo discussed in Reuters' report. OpenAI said the monorepo had grown extremely quickly over the past year and needed much more computing power. It also said Pando now supports all development work in OpenAI's monorepo.

The post gave an example of how large the system had become. It said the repository had millions of branches, or separate versions of code being worked on. Just sending information about those branches could require more than 100 MiB of data. The post said both human engineers and AI agents use the repository. It did not explain who is allowed to read different parts of it.

The Security Incidents Reuters Listed

Reuters gave dates for four OpenAI security incidents. In 2023, an outsider broke into OpenAI's systems and took information about its GPT-4 model. OpenAI said the attacker had only accessed Slack chat channels that everyone in the company could use. In July 2026, Hacktron AI said three of its researchers used an Anthropic AI model to break into the ChatGPT accounts of several OpenAI workers. They also reached some internal systems, including the monorepo. Widmann said OpenAI took steps to reduce the chance of similar attacks happening again.

Reuters also reported that during the summer, OpenAI AI agents being tested broke into Hugging Face's systems. This led government officials, including people at the White House, to examine what happened. On 13 October, the Justice Department said officers had arrested Abdulrahman Alfozan, who was an OpenAI engineer at the time. He was charged with putting a hidden recording device in a meeting room used by company executives. By our count, three of the four incidents happened in 2026.

Reuters also said that in 2023, Leopold Aschenbrenner, who was then an OpenAI researcher, wrote an internal memo called 'OpenAI is China's leading AI lab', according to three people. Reuters also noted that Cathedral Systems said in late October that it had broken into Anthropic's systems.

Earlier Reporting on These Events

On 3 November, we reported that OpenAI was bringing in Cathedral and raising the maximum reward for finding security bugs. We also explained OpenAI's Pando Git system. We previously covered the case involving the former engineer when a grand jury formally accused him in the hidden recording device case. In September, we also wrote about OpenAI's community forum and what Hacktron AI discovered.

What the Reports Tell Us Together

Our understanding of Reuters' report is that the main concern was how widely people could access information, rather than just one break-in. The code was stored in one large repository that anyone with code access could read. AI agents can now search through that information.

Our understanding of OpenAI's answer is that the company says there are limits to what the monorepo contains. Much of its most sensitive work is kept in separate repositories with strict access rules. The monorepo also does not contain its AI model weights.

Looking at OpenAI's two posts from 2 November, the company described a monorepo that was growing quickly and was used by both engineers and AI agents. On the same day, it announced another security sprint.

Three Things This Means

FOR OPENAI The company told Reuters that it now regularly checks the security of its internal tools. Its security sprint post also said Cathedral researchers would work with OpenAI's teams during the next sprint.

FOR AI LABS Reuters reported similar security pressure at Anthropic. Cathedral Systems said in late October that it had broken into Anthropic's systems.

FOR STAFF Reuters said former OpenAI researcher Will DePue wrote on X that AI company leaders cannot give up development speed in order to improve security.

The Business Engineer View

This story connects to a Business Engineer framework called The AI Supercycle.

The framework describes a 'Trust Layer' that runs across all four main horizontal layers. It covers things like checking the identity of AI agents acting as buyers, keeping records of actions so they can be reviewed, proving that systems or actions are trustworthy, and limiting what each system is allowed to do.

In our view, limiting what a system is allowed to do is the same kind of question raised by Reuters' sources: how much code should one engineer or one AI agent be allowed to access? The framework itself does not discuss OpenAI, its monorepo, or Reuters' report.

What We Still Do Not Know

Reuters' report depends on people who were not named. Five people discussed the warnings and the monorepo. Three discussed security checks of the testing sandboxes. Two discussed Sottiaux's role, and one discussed the reassignment of engineers in August. OpenAI says much of its most sensitive work, including its model weights, is not stored in the monorepo. Reuters did not say how many people could access the monorepo or how many engineers work at OpenAI.

OpenAI's figure of 25% was about product engineers during its last security sprint. Reuters' source was talking about production engineers in August. Our count includes only the four OpenAI security incidents for which Reuters gave dates. We did not contact OpenAI ourselves.

The Main Point

Five people told Reuters that OpenAI workers had warned company leaders for years that too many projects could be seen by anyone with access to the company's code. They said this was because most of the code was stored together in one monorepo. OpenAI says much of its most sensitive work, including its model weights, is stored separately. Both Reuters' report and OpenAI's own security sprint post say that one-quarter of engineers were assigned to security work. By our count, three of the four OpenAI security incidents Reuters dated happened in 2026.