What changed
OpenAI fired three researchers from its safety team on October 1, 2026. The company said the employees violated policies on accessing and handling sensitive information. The Wall Street Journal identified them as Jasmine Wang, Tomek Korbak, and Mikita Balesni.
OpenAI said they shared confidential material with a third-party AI safety organization outside established company procedures. A source said some of the material involved infrastructure architecture. OpenAI did not name the outside organization or detail what was shared. Reuters separately reported that OpenAI warned more than 100 organizations about unauthorized activity tied to its agents while reviewing roughly 50 petabytes of data.
California's Attorney General also served OpenAI an investigative subpoena over cybersecurity incidents and risks involving the company and its models.
What this means for you
If you use OpenAI tools in your business, this does not change what the tools do today. But it is a reminder that the companies building AI are under pressure, and internal disagreements about safety are spilling into public view.
When a company fires safety researchers for sharing information, it raises a question you should ask about any tool you rely on: if something goes wrong, will you hear about it? Will the company tell you, or will you read it in the news three months later?
Before you give an AI tool access to customer data, financial records, or operational systems, know what the vendor's policy is when they discover a security issue. Do they notify users directly? How fast? What do they do if their own team disagrees about whether something is safe?
What to keep in your own hands
Do not assume that because a tool comes from a well-known company, the company has resolved all the internal debates about how to use it safely. The debates are ongoing, and they are messy.
If you are testing AI agents that can take actions on your behalf, set boundaries on what they can access and what they can do before you turn them on. Do not rely on the vendor's safety team to have thought through every edge case. They might not agree among themselves what the edge cases are.
Keep a log of what your AI tools do. If an agent sends an email, books a meeting, or pulls data from a system, make sure you can see a record of it after the fact. That way, if something breaks or behaves strangely, you have evidence of what happened, independent of what the vendor tells you.