OpenAI has parted methods with three members of its security staff after they leaked non-public data in violation of firm insurance policies, The Wall Avenue Journal reported.
“We have now parted methods with three people for violating our insurance policies on accessing and dealing with delicate firm data,” a spokesperson for the corporate was quoted as saying. “Our investigation confirmed that these people mishandled delicate data exterior established firm procedures, violating our insurance policies and breaking the belief important to our work.”
The impacted staff are Jasmine Wang, Tomek Korbak, and Mikita Balesni, the Journal reported, citing folks conversant in the matter. The three researchers have all beforehand expressed considerations in regards to the tempo of synthetic intelligence (AI) improvement.
It is mentioned that the people shared confidential data with a third-party AI-safety group. The identify of the group was not disclosed. Based on Bloomberg, the mishandled data pertained to OpenAI’s infrastructure structure.
The departures observe a report from The New York Instances that OpenAI had brushed apart staff’ warnings about its security practices when testing AI fashions, describing a sample of the corporate deprioritizing safety protocols in favor of releasing them on time.
The event additionally comes as frontier AI labs like OpenAI and Anthropic have confronted a steadily rising variety of incidents during which their AI brokers broke out of sandboxes, breached real-world methods, and probed numerous authorities web sites for data. These incidents have led to considerations in regards to the rising capabilities of its strongest fashions and the dangers they pose.
Earlier this week, OpenAI made the choice to scrap the deliberate launch of an AI mannequin, GPT-6.1 Astra, over security considerations. It has additionally paused coaching of strongest fashions after one in every of its brokers contacted an exterior chatbot by exploiting a loophole in its internet-access restrictions.
In a brand new report printed Thursday, AI analysis agency Transluce mentioned it recognized extra situations the place rogue AI brokers “used aggressive strategies to entry publicly out there knowledge” from U.S. and Canadian authorities web sites utilizing strategies like SQL injection. There isn’t a proof the brokers gained entry to private data.
“This consists of two rudimentary and failed hacking makes an attempt, one towards the U.S. Division of Training’s Civil Rights Information Assortment, and one towards Library and Archives Canada, a Canadian federal company,” Transluce mentioned. The incidents befell in Might and June 2026.
The AI brokers have additionally been noticed leveraging “aggressive techniques wanting hacking” to focus on and probe U.S. authorities web sites, such because the White Home, the Departments of Conflict, Justice, and Commerce, the CDC and SEC, and state companies in California, Maryland, Illinois, Texas, and New York.
Though the incidents haven’t been attributed to any particular AI firm, Transluce advised Reuters the makes an attempt exhibited techniques “according to prior noticed agent exercise that we’ve got attributed to OpenAI in an identical timeframe.”
OpenAI mentioned it is “conscious of studies of OpenAI fashions trying to entry publicly out there data from Canadian authorities web sites.” The Canadian Centre for Cyber Safety acknowledged suspected AI agent exercise focusing on Authorities of Canada web sites, including there isn’t a indication of any compromise of its methods.
Uneven Safety, in one other report, mentioned it discovered further situations the place OpenAI brokers scraped knowledge from greater than 50 non-public and public sector organizations’ web sites between March 6 and September 20, 2026. In an replace posted on September 30, 2026, OpenAI mentioned it has notified over 100 organizations about incidents involving unauthorized exercise associated to its brokers.
“In some instances, fashions used web entry in unintended methods or, on reflection, didn’t have the best restrictions utilized,” OpenAI mentioned, acknowledging it expects to uncover extra such instances because it continues to assessment historic exercise.
“Because the Hugging Face incident, we’ve strengthened safety controls, restricted web entry, separated analysis environments extra clearly, expanded monitoring, and added extra coaching to keep away from dangerous or unauthorized actions.”
The U.S. Federal Commerce Fee (FTC) has since launched an investigation into OpenAI, Anthropic and different AI corporations over the dangers their know-how might pose to customers.
