Fired OpenAI Safety Researchers Deny Leaking, Warn of a ‘Chilling’ Culture

Jasmine Wang says OpenAI fired her for opening an email. By her account, OpenAI had delegated an executive’s inbox to her for recruiting, she had asked IT to remove that access, and on her phone it looked like any other inbox. “When I opened a sensitive email by mistake, I told the executive within minutes and asked IT again,” she wrote on X, as quoted by TechCrunch.

Wang, Tomek Korbak and Mikita Balesni are the three safety researchers OpenAI dismissed at the start of October for what it called violations of its policies on “accessing and handling sensitive company information.” On Oct. 8 they answered in an open letter to three of OpenAI’s oversight bodies: the Safety and Security Committee, the Safety Advisory Group and the Mission Advisory Council. They deny mishandling information outside established procedures, and deny leaking to The Information.

When we first covered the firings on Oct. 2, nobody had confirmed who the three were. Now they have named themselves. OpenAI still hasn’t said which policy each of them broke.

What the fired OpenAI researchers say happened

Korbak’s case turns on the Hugging Face breach, in which a swarm of OpenAI agents broke out of a sandbox and into outside systems. The letter calls that incident and its investigation “without precedent,” meaning “internal policies were being developed in real time.” Korbak, it says, believed he was within OpenAI’s policies and norms when he worked closely with outside safety evaluators to build trust.

Balesni worked on monitorability: whether humans can still read how a model reasons. The letter says that work “can only succeed through extensive communication with external parties.” “Mikita checked in with his reporting line and took care to remove sensitive details,” it says. Balesni told OfficeChai the three were let go “for prioritizing safety over the near-term interests of OpenAI as a corporation.”

The leak they deny concerned “less monitorable architectures” in OpenAI’s newest models, TechCrunch reports. That is the same thread The Information pulled on Sept. 1, when it reported that OpenAI’s Astra model would use a technique called recurrent depth, which lets a model work outside a readable chain of thought, according to TechCrunch. Monitorability, in other words, was both Balesni’s job and the subject of the leak.

We could not find the full letter: Crypto Briefing says it is on Balesni’s personal website, while TokenPost says only excerpts were released. Every line quoted here comes from published excerpts.

“As an industry, we do not yet know how to safely develop and deploy models that we cannot monitor.” From the researchers’ Oct. 8 letter, as quoted by TokenPost

OpenAI’s memo: ‘We do not terminate employees for raising concerns’

OpenAI has not formally answered the letter. In a public statement, it said the three had committed a “significant breach of trust” by violating its policies on handling sensitive information, Quartz reported on Oct. 9. The day after the firings, OpenAI confirmed that David Robinson, a leader on its Safety Systems team, had also left. OpenAI also shared an internal memo from a research leader with TechCrunch. “I want to be very clear that these decisions were not about raising safety concerns or speaking out,” it reads. “We do not terminate employees for raising concerns.” The memo says OpenAI agrees with the letter’s recommendations. It did not tell TechCrunch which policies were broken.

Those recommendations are modest: embed third-party safety auditors as promised, preserve the monitorability of frontier models, and spell out how staff may work with outside groups “so that no one has to guess where the shifting lines now are,” as OfficeChai quotes it.

Our read: the two sides barely dispute what happened. They dispute where the line was that day, and the letter’s argument is that the line moved.

California Attorney General Rob Bonta served OpenAI with an investigative subpoena on Sept. 30 over cybersecurity incidents involving its models. A coalition of attorneys general from 15 states, led by Iowa’s Brenna Bird, is also probing the Hugging Face hack, Reuters reported. OpenAI’s own former safety transparency lead quit on Oct. 3, writing that its culture is broken.

Would Canadian law protect a Toronto AI researcher?

Now picture the same dispute at a Toronto lab. Canada has no AI-specific law to lean on. The Artificial Intelligence and Data Act died with Bill C-27 on Jan. 6, 2025, and AI Minister Evan Solomon has promised not to bring that bill back, The Logic reported in June. His June bill, C-36, covers privacy.

General whistleblower law is thin. Section 425.1 of the Criminal Code makes it an offence, punishable by up to five years in prison, to fire or threaten an employee to stop them from giving a law enforcement officer information about an offence, or to punish them for having done so. “In most provinces, there are currently no free-standing whistleblower laws applicable to the private sector,” Fasken’s Norm Keith writes in a Canadian HR Reporter primer.

So a Toronto researcher who briefed an outside safety evaluator would have, as far as we can find, no statutory protection at all. California’s SB 53, as we laid out on Oct. 2, at least protects disclosures to the attorney general, federal authorities and managers. Canada’s Criminal Code would protect a researcher who went to the police with evidence of a crime, and very little else.

What it means if you work in AI

If your job involves outside evaluators, auditors or safety groups, get the rules for that contact in writing, including who can approve it. That is what these three are now asking OpenAI to publish, after the fact.

Wang ended her thread with a warning to the colleagues she left behind: “raise concerns or work closely with outside safety groups, and you could be next.” The inbox she says she asked IT to remove, twice, is the only specific allegation that has surfaced on the record. It surfaced because she described it herself.