OpenAI announced plans on Nov. 2 to bring outside researchers into a new security sprint. Reuters reported on Nov. 3 that employees had raised concerns with leaders before ChatGPT’s late-2022 launch.
On Nov. 2, OpenAI said researchers from Cathedral Systems would work with its teams and models during the effort. The company said 25% of its product engineers took part in its previous sprint, which focused on finding and fixing weaknesses. It also plans to increase rewards for critical bug bounty findings by more than fourfold, without stating the new amounts or when the changes will take effect.
In a report published Nov. 3, Reuters cited five people familiar with OpenAI’s practices who said employees had brought security concerns to senior leaders and the board before ChatGPT launched. The sources described a repository setup in which employees with access to OpenAI’s code could view technical details about projects beyond their own work. They also said the internal environments used to test models were not regularly reviewed for security.
Reuters separately reported that OpenAI said access to sensitive work was restricted, its main code repository did not contain all company code or model weights, and internal tools now receive regular reviews. OpenAI spokesperson Elana Widmann told Reuters, “Protecting our technology, data, and people is a responsibility we take seriously.”
The report described a tension between protecting AI technology and maintaining the pace of development. Reuters’ sources said added controls could take engineering time, slow work and potentially complicate IPO plans at OpenAI and Anthropic. Reuters also said the companies’ comparatively open research practices help them recruit employees and encourage creative work.
OpenAI has not announced when its next security sprint will begin.
