OpenAI Probed Safety Researchers’ Signal Messaging Before Firings

AI developer OpenAI examined safety researchers’ personal phones during a leak investigation before dismissing three employees, according to a Wall Street Journal report. Two researchers say disappearing Signal conversations with an outside safety collaborator were cited in their terminations, putting contacts they considered part of their jobs at the center of a dispute over company secrets.

The employees, Tomek Korbak, Mikita Balesni and Jasmine Wang, deny sharing confidential information. OpenAI says its investigation found violations of sensitive-information policies and that the dismissals were unrelated to raising safety concerns. Its spokeswoman told the Journal that Signal was unapproved, but was not the sole reason for the firings.

The Messages and the Leak Investigation

Security staff asked the three to unlock their phones in September, the Journal reports. Some had enabled disappearing messages in chats with Ryan Greenblatt, an outside AI safety researcher who was then chief scientist at Redwood Research. The three employees were fired at simultaneous meetings a week later.

The Journal traces the leak inquiry to a September 1 story by The Information about the internal design of Astra, an OpenAI model. That story claimed a new technique made the model more powerful while revealing less of its reasoning. OpenAI chief scientist Jakub Pachocki called that reporting confused, according to the Journal. Within weeks of the Information story, an OpenAI official announced an internal leak investigation.

OpenAI suspected the three of leaking internal model-design information to an outside safety researcher, the Journal reportes. Balesni says investigators named Greenblatt as the suspected leaker and asked to inspect their Signal chats. He and Korbak say company leaders cited disappearing messages as a reason for their dismissals. Korbak says he was told his third-party contacts used unsanctioned channels, while he regarded disappearing messages as a normal security precaution.

Greenblatt denied being the source of confidential leaks to The Information. The three former employees say they received no written explanation identifying the sensitive material they allegedly mishandled. Earlier, in an October 8 response to TechCrunch, OpenAI alleged a broader pattern of misconduct extending beyond sharing with an outside evaluation group.

The Safety Work Behind the Conversations

OpenAI put Korbak on its collaboration with METR, a nonprofit that evaluates AI risks, to investigate the recent intrusion into the AI platform Hugging Face. METR contracted Greenblatt to help analyze the incident logs. Korbak says they communicated through OpenAI’s Slack as well as Signal.

OpenAI says research and safety vice president Mia Glaese wanted to protect its intellectual property, while Korbak says he worried METR would receive insufficient access. In their letter to OpenAI’s board, made public on October 8, the researchers say close contact with outside counterparts was essential to building trust during an unprecedented investigation whose internal rules were still developing.

METR and Redwood’s evaluators spent six days onsite, with OpenAI providing extra visits and datasets, their joint account states. They lacked direct access to infrastructure data and could not query the main model. Given the volume of material and limited time, they relied heavily on AI analysis that was difficult to verify, reducing their confidence compared with simpler investigations. They also say AI assistance made the inquiry feasible within the time available.

Balesni’s outside conversations concerned a different project: persuading AI companies to preserve their ability to inspect models’ intermediate reasoning. Reasoning models can write out steps before answering or acting. An automated chain-of-thought monitor can read that text alongside other information and flag suspicious behavior, allowing an action to be blocked, replaced or examined more closely.

Their 2025 position paper explains why designs that perform more reasoning internally, without writing down intermediate steps, could remove information those monitors use. The text is an incomplete view of a model’s computation, but can provide an additional safety layer.

Greenblatt drafted a proposal for companies to avoid designs that expose fewer reasoning steps. By August, Balesni and colleagues had developed a similar proposal inside OpenAI. Balesni says he discussed it with a board member and senior executive, received authorization to discuss it with Greenblatt, and shared a version stripped of company secrets.

The researchers deny sourcing the Information story, arguing in their letter that it undermined the cross-company limits on less monitorable designs they were trying to secure.

The same paper says directly supervising a model’s reasoning might improve its alignment with intended behavior enough to justify losing some ability to monitor it.

Wang Describes a Separate Inbox Dispute

Wang says she was told she was fired for repeatedly accessing an executive’s email. In her account, access delegated for recruiting persisted for nearly a year after she asked IT to remove it.

She says she could not remove the access herself, and the combined inbox on her phone did not distinguish which account a message was intended for. After accidentally opening a sensitive email, she says, she told the executive within minutes and again asked IT to remove the access. OpenAI’s spokeswoman told the Journal that the company did not have a problem with the access itself.

Outside Access Comes With Information Limits

Adam Gleave, chief executive of AI safety group FAR.AI, said evaluators could compare models at different stages of training to see when concerning behavior emerged. Logs and employee interviews could help them check whether a developer’s public safety claims match its internal practices. He said FAR.AI had rejected contracts that gave developers too much control over evaluation.

Separately from the Hugging Face inquiry, one METR researcher and one Redwood researcher tested OpenAI’s internal monitoring from July 21 to August 11. METR’s October 22 account describes access to internal code, monitoring settings and documents, plus interviews with about a dozen researchers and engineers. METR says that access and OpenAI’s support substantially benefited the work.

The pilot’s publication terms were narrower than its technical access. The participants agreed to release only a brief, high-level public account. OpenAI could redact information it considered sensitive, and the evaluators lacked a unilateral right to describe those redactions.

Anthropic’s October 15 access terms, clarified on October 16, cover six embedded METR employees with internal tools and systems roughly comparable to its risk assessment teams. Staff are encouraged to share information with that team, subject to defined exceptions including models’ internal designs, or architectures. Highly relevant architecture information generally requires explicit internal approval to share.

Under that arrangement, Anthropic cannot veto an entire publication, but can require redactions within predefined categories and decides what falls into them. METR can describe the level of access and information it received.

The fired researchers are asking OpenAI to set clear rules for staff contact with external auditors. Korbak says colleagues have told him they fear such conversations and raising safety concerns.