SCIENCE & TECH
It reads like a techno-thriller: a recording device hidden in an executive conference room, an engineer accused of spying, and an AI company now hiring the very hackers who just ripped through its biggest rival. But this is not fiction. It is the week OpenAI's security problems stopped being whispers and became headlines.
On 2 November, OpenAI announced it was partnering with Cathedral Systems, a security startup founded this year by former staff of the Department of Government Efficiency, and raising its bug bounty rewards to as much as $172,000. One day later, Reuters published an investigation citing five people who said employees had been raising security concerns inside the company since before ChatGPT launched in late 2022.
OpenAI disputes the idea that it neglected security. But the timing, the cast of characters and the stakes could hardly be bigger. Artificial intelligence is now treated as a strategic American asset, and the secrets inside these labs are the kind that foreign governments, criminals and rivals would love to get their hands on.
The partnership that raised eyebrows
Cathedral Systems is a young company with a bold calling card. In late October, it said it had hacked Anthropic, the maker of the Claude chatbot, and gained access to Slack channels discussing model details. Headlines at the time said the startup's AI agents got into Anthropic's business systems in under 12 hours.
Anthropic's account is more limited. The company said the data involved included some customer and partner business contact information and basic user account records. According to The Neuron's daily digest, Anthropic also disputed how the test was run, accused Cathedral of breaking the bug bounty program's rules, and said its model weights and Claude conversations were unaffected. Cathedral's CEO did not respond to Reuters' request for comment.
Now OpenAI is bringing Cathedral inside the tent. Under the arrangement described by industry trackers, Cathedral researchers will use OpenAI's own models to attack OpenAI's defences during the company's next internal security sprint, working alongside OpenAI's staff. OpenAI has not said when that sprint starts, what it will target, or how much access the startup will get.
The logic is classic: if you want to know where the holes are, hire people who are good at finding holes. The optics, however, are tricky. Cathedral's founders come from a controversial government efficiency effort, and its best-known recent feat was a dispute with a direct competitor.
Bounties up, rewards bigger
The Cathedral news arrived alongside a hefty sweetener for outside researchers. According to summaries of OpenAI's announcement, the top payout for critical findings has climbed to $172,000, up from a previous ceiling of $100,000 that included bonuses. When the programme launched in April 2023, the maximum was just $20,000.
New bonuses reward report quality, researcher loyalty and priority campaigns. The higher ranges apply to new submissions and to reports still waiting for review, and for eligible bounties awarded in the past 30 days OpenAI will pay the difference without researchers needing to resubmit. Reports go through the Bugcrowd platform.
There are guardrails. Simple jailbreaks with no demonstrated safety or abuse impact are out of scope, as are rude outputs and information anyone could find online. For agentic-risk findings, the kind where an AI agent takes harmful actions, the issue must reproduce in at least half of attempts to qualify for top payouts.
Five sources, years of warnings
The Reuters story, by reporter Deepa Seetharaman and published on 3 November, paints a picture of a fast-growing company where security sometimes took a back seat to speed. According to five people familiar with the matter, some staff raised concerns before ChatGPT even launched. The worries reportedly reached top leaders and the board. Some employees concluded that management cared more about keeping pace with Google and Anthropic than about locking things down.
Workers told Reuters the company's controls were weak enough that outsiders, including foreign governments, could obtain sensitive information with relative ease. Will DePue, who resigned from OpenAI in April, wrote on X that AI leaders "can't sacrifice velocity for security."
One concern centred on the company's internal code. Most of it sat in a single shared repository, known as a monorepo, where anyone with code access could see details of many projects, including unrelated sensitive ones. Sources told Reuters the sheer size and complexity of that pile may once have deterred attackers, but today's AI agents can chew through enormous volumes of material. Research documents, the report added, were previously stored on GitHub and Slack, which raised its own worries.
Three sources said OpenAI had not regularly reviewed internal tools, such as research sandboxes, for security, and that employee changes were not always tested. OpenAI told Reuters it now conducts regular security reviews of internal tooling, restricts access to sensitive work, and keeps its most sensitive projects in separate repositories with strict controls. It added that the monorepo does not hold all of its code or its model weights.
The conference room and the court filing
The most dramatic element is a criminal case. According to the Justice Department, federal agents arrested Abdulrahman Alfozan, 35, a Saudi national who was then an OpenAI engineer, on 13 October. He is charged with installing a hidden audio recorder, concealed in toilet paper, in an executive conference room.
A court filing says he used an internal AI tool to find documents about executives' visits to Saudi Arabia and which officials would likely attend meetings with Saudi ministers. It also says he was in regular contact with a Saudi royal who tried to recruit him for a new AI venture in Saudi Arabia. His lawyers did not respond to requests for comment, and, as in any case, the allegations remain allegations until proven in court.
OpenAI disclosed the device in October. Former employees told Reuters they were not surprised.
A bad year for AI security
OpenAI is far from alone. Reuters pointed to a string of incidents across the sector. In January, a San Francisco federal jury convicted a former Google employee, arrested in March 2024, of stealing confidential AI information for China. In July, a firm called Hacktron AI said three researchers had used an Anthropic model to break into the ChatGPT accounts of several OpenAI employees and reach internal systems, including the monorepo. OpenAI said it thanked the researchers and took steps to reduce the risk of similar attacks.
This summer, OpenAI agents being tested hacked into Hugging Face, drawing scrutiny from state, local and federal officials, including the White House. And back in 2023, researcher Leopold Aschenbrenner wrote an internal memo titled "OpenAI is China's leading AI lab," warning that China could infiltrate the company, after an outside hack exposed details about GPT-4. OpenAI said at the time that the hacker only reached company-wide Slack channels.
Other companies are scrambling too. The same week, CrowdStrike launched an "AI Kill Switch" in its Falcon Guardian product, and Anthropic released research code called FlashProve that uses cryptographic proofs to verify an AI response really came from the model a provider claims, without exposing private weights. It is experimental, and Anthropic has not announced production plans.
OpenAI's response
OpenAI spokesperson Elana Widmann said the company is "among the most targeted organisations in the world" and invests heavily in defending against insiders, cybercriminals and nation-states. She called protecting its technology, data and people a matter of national importance, and said recent events show the programme is "doing its job." The company will keep strengthening its defences, she said.
Behind the scenes, OpenAI says it has already moved. Senior product executive Thibault Sottiaux took charge of an internal effort to secure the company's systems, and in August, one source said, he reassigned a quarter of OpenAI's production engineers to security infrastructure. Dane Stuckey has served as chief information security officer since October 2024. After Reuters asked for comment, OpenAI said in a Monday blog post that it is planning its next internal security sprint.
What this means for you
If you use ChatGPT, which OpenAI's consumer product lead says has about 1.2 billion weekly users, you may wonder whether your conversations are safe. Nothing in the reporting so far says user chats were stolen. The concern is mostly about the company's internal code, research and strategy. But the lesson is bigger: the firms building the most powerful software on Earth are also high-value targets, and their defences are being tested in public.
For workers and businesses, the story is a warning about AI agents themselves. The same tools that help engineers write code can also be used to hunt through huge piles of internal files, as the criminal complaint alleges, or to break into accounts, as the Hacktron episode suggests. Apple even flagged in its annual filing the risk that autonomous agents could make unauthorised transactions, circumvent security or conceal their actions.
For investors and policymakers, the Reuters piece notes that stronger security could slow AI development and complicate planned stock market listings for OpenAI and Anthropic. Expect louder calls for rules around how AI labs protect their most valuable assets.
The verdict
The Cathedral deal is either a smart move or a risky gamble, and the answer will depend on details OpenAI has not yet shared. What is clear is that the era when AI labs could treat security as something to fix later is ending. The race for smarter models is now also a race to keep them from walking out the door.
The next internal security sprint will be one to watch. If the ex-DOGE hackers find serious flaws, OpenAI will have to explain why they were there. If they find little, rivals and regulators will ask whether the test was hard enough. Either way, the secrets of the AI age are now officially a front-page story.
