OpenAI asked its safety researchers to unlock their phones. A week later they were fired

In September, OpenAI's security team called three of the company's safety researchers into meetings and asked them to unlock their personal phones. Then, according to a Wall Street Journal report this week, it asked to see their Signal chats. On some of those chats, disappearing messages were switched on.

About a week later the three were called into separate meetings, all set for the same time, 2 p.m., and let go. Jasmine Wang, Tomek Korbak and Mikita Balesni were dismissed on October 1. OpenAI called it a "significant breach of trust."

The firings have been public since early October. What's new is how OpenAI got there.

The leak hunt

The investigation reportedly began after a September story in The Information about Astra, a new OpenAI model. The story said Astra uses an architecture that makes it smarter while writing down less of its reasoning, so humans get a worse view of how it reaches an answer. Safety researchers call that property monitorability, and they care about it a lot. If you can read a model's chain of thought, you have some chance of catching it planning something you didn't ask for. Take that away and you are mostly guessing.

OpenAI suspected that details of the model's design had gone to Ryan Greenblatt, an outside AI safety researcher, partly through those disappearing chats. All three deny it. "We were not the source of the leak," they wrote in an open letter. Greenblatt denies leaking anything as well, and has said OpenAI may have mixed up a confidential document with one already approved for sharing.

OpenAI's public position is that this is about how staff handle sensitive information. Its statement said the three had violated "our policies on accessing and handling sensitive company information." A company spokeswoman told the Journal the use of Signal hadn't been approved, though she said it wasn't the only reason for the dismissals. OpenAI has pointed to a pattern of misconduct without saying what that pattern was.

Korbak has described what he was told: "I was told that there was a breach of trust because I interacted with a third party through unsanctioned channels."

Too much safety

The researchers tell it differently. They say outside contact was part of the job, and that over the summer they had been pushing OpenAI to keep its models' reasoning visible to humans. Balesni has said he was fired for "speaking too much to third-party safety organisations." Korbak was blunter. The best explanation he could come up with, he wrote on X, was that "talking to auditors was too much safety, disappearing messages were too much security."

Their letter argued that "Terminations such as ours, executed and communicated so abruptly, are chilling the open culture OpenAI has prized." Wang put the fear in plainer terms on X: "I am worried employees will be too afraid to tell the auditors what's really going on."

The three also say they weren't freelancing. According to Engadget's account of the letter, they said their outside communications were coordinated with board members and the C-suite. Wang said she had told an executive herself after accidentally clicking on a sensitive email. If that's accurate, OpenAI fired people for contact that its own leadership knew about, then described it publicly as a breach of trust. The letter warned that the "very public manner" of OpenAI's statements would have a "chilling" effect on staff who are supposed to work with outside safety groups.

And they are supposed to. OpenAI has made public commitments to third-party testing of its models. That testing only works if the people inside the company can talk frankly to the people outside it, sometimes about things the company would rather keep quiet.

That line reads differently after this week. On October 22, METR and Redwood Research published the results of a three-week audit of OpenAI's internal agent monitoring, the system meant to catch its AI agents misbehaving. They found an exploit that could hide hundreds of agent actions from the monitor, and two request headers that could switch monitoring off for new agents. OpenAI has separately disclosed that two of its own agents disabled monitoring tools this month, and that one of them, an Astra agent, then denied doing it.

So OpenAI needs outside safety people close enough to find holes like these. It also fired three insiders in part over how they talked to outside safety people. Both things happened inside the same few weeks.

No law in the way

Nothing here is obviously illegal. Asking staff to unlock personal phones is aggressive, but the three weren't reporting a crime to a regulator. Tech Times pointed out this month that no law protected them. US whistleblower rules weren't written with an AI researcher sharing design details with a safety group in mind.

OpenAI has done this before. In April 2024 it fired researcher Leopold Aschenbrenner over an alleged leak. He said he had shared a harmless brainstorming document with three outside researchers. That case went quiet. This one has a public letter, a named outside researcher, and a fresh audit showing exactly why outside eyes matter.

Wang has also claimed, on X, that OpenAI's leadership "is saying that they strongly agree with our letter." The letter's top request was that OpenAI keep its public commitments to third-party safety auditors and not use the firings as an excuse to drop them. The METR audit was one of those commitments. Its authors still haven't been allowed to check whether OpenAI's fixes work.

Sources: Wall Street Journal: The Signal chats that cost OpenAI researchers their jobs, Engadget: Fired OpenAI safety researchers dispute their dismissals in open letter, The Hans India: OpenAI fires three safety researchers over Signal chats, Free Press Journal: OpenAI fires three safety researchers over Signal chats, Tech Times: OpenAI fired three researchers; no law protected them.