OpenAI wants outside hackers to find weaknesses in its security. The awkward part? Some of its own employees reportedly spent years warning about those weaknesses, long before the company decided to bring in outside help.
On November 2, OpenAI announced a partnership with cybersecurity startup Cathedral Systems, whose researchers recently found their way into business systems used by rival Anthropic.
A day later, Reuters published an investigation revealing that employees had raised concerns about OpenAI’s internal security practices as far back as 2022, before ChatGPT even launched.
According to the report, employees worried that sensitive research was too widely accessible and that some internal tools weren’t regularly reviewed for security problems.
Now OpenAI is asking outside researchers to test its defenses using the very AI technology it’s trying to protect.
The question is whether those tests can help resolve the problems employees had already identified, especially as AI agents become increasingly capable of finding vulnerabilities on their own.
One of the biggest concerns involved who could access OpenAI’s internal code.
According to five people familiar with the company’s practices who spoke to Reuters, employees with access to OpenAI’s code repository could view technical information from projects unrelated to their jobs.
Much of the company’s code was kept in a single shared repository, known as a monorepo. Think of it as one enormous collection of software projects, where employees with access could potentially examine work beyond their own assignments.
Some employees also worried about research documentation stored in internal tools such as GitHub and Slack.
So, what was the problem with giving employees access to so much information?
If someone compromised an employee account, they could potentially explore research and technical documents that the employee had no business accessing in the first place.
And AI agents make large repositories easier to search. What might previously have required hours of manually examining files could become much faster with an AI assistant capable of finding relevant code and documents.
Advertisement
Reuters reported another concern involving OpenAI’s internal testing environments, where researchers experiment with new models. Employees frequently modified these tools, but some changes reportedly went through limited security reviews.
Several employees raised their concerns with company leadership and board members. Some eventually concluded that management was more interested in keeping pace with competitors than addressing the risks.
OpenAI disputes the suggestion that it neglected security.
The company told Reuters that much of its most sensitive research is stored in separate repositories with restricted access. It also said its shared code repository doesn’t contain all its projects or critical model weights, the numerical values that determine how AI models behave.
OpenAI says it now conducts regular security reviews of its internal tools.
Spokesperson Elana Widmann also told Reuters that OpenAI invests heavily in protecting its systems from insiders and external attackers.
Those responses offer some reassurance, but Reuters’ reporting leaves questions about how the company’s access permissions and security reviews changed over time.
OpenAI has already started making changes to its security operations.
During an earlier security sprint, the company said it assigned 25% of its product engineers to finding and fixing vulnerabilities.
The engineers used Codex to investigate potential weaknesses, reproduce problems in isolated environments, and prepare patches for review.
Now OpenAI is expanding that approach through its partnership with Cathedral Systems.
Cathedral’s researchers will work alongside OpenAI’s internal teams and use OpenAI models to test the company’s defenses. The announcement describes plans to find weaknesses and verify fixes, although it doesn’t specify exactly which internal systems Cathedral will examine.
There’s also a financial incentive for researchers outside the partnership.
On November 2, OpenAI announced higher bug bounty rewards, with exceptional critical vulnerabilities eligible for payouts of up to $172,000, including bonuses.
The company says these efforts will help it identify vulnerabilities before attackers can exploit them.
Advertisement
But there’s an obvious question here: Why bring in Cathedral specifically?
Its recent encounter with Anthropic gives us a clue.
Cathedral made headlines in October after its researchers used AI agents to find vulnerabilities in Anthropic’s systems.
According to The Washington Post, the researchers initially tried to break into Anthropic’s software but were unsuccessful.
They eventually turned their attention to third-party business apps, the kind companies use for administrative work and managing customer information.
Using AI agents, Cathedral reportedly found paths to internal information in less than 12 hours.
Its findings described access to meeting transcripts and employee information, including salary details. The researchers also reported reaching Slack messages discussing Anthropic’s AI models.
Anthropic confirmed that Cathedral accessed a limited set of its sales, human resources, and IT systems. However, the company said the researchers couldn’t access customer conversations with Claude, its source code, or model weights.
Anthropic also challenged Cathedral’s account. It said its monitoring systems detected some suspicious activity before the researchers reported their findings, and accused Cathedral of failing to disclose all its actions under the company’s bug bounty rules.
The affected business apps were disabled until vendors addressed the vulnerabilities. For OpenAI, the episode shows what external researchers might uncover.
An AI company could have carefully protected model research while a connected business app still exposes internal documents or employee information. Cathedral’s Anthropic findings show how attackers could reach valuable information through workplace software.
The startup now has an opportunity to examine OpenAI’s defenses under an authorized partnership. Whether it finds similar weaknesses remains to be seen.
External security researchers can help identify weaknesses that internal teams may have missed. They typically do this through penetration testing, where they attempt to exploit vulnerabilities under agreed conditions.
For example, researchers might examine whether an employee account can access confidential research outside its assigned project. They could also investigate whether connected business apps expose sensitive information or whether security systems detect suspicious activity.
Advertisement
If researchers find a vulnerability, engineers can develop a fix and test whether the same attack still works afterward. Of course, the results depend on which systems researchers can examine and how thoroughly the company follows up.
One successful security exercise cannot establish that every internal application is protected, especially when employees continue changing software and permissions.
We’ve already seen why verification is necessary.
In October, The Neuron reported that researchers from METR and Redwood Research had identified vulnerabilities in OpenAI’s agent-monitoring systems. Some flaws could prevent monitoring systems from recording actions taken by AI agents.
OpenAI said it patched the affected safeguards, although the researchers hadn’t independently verified those fixes.
The Cathedral partnership concerns a separate initiative, but the earlier findings illustrate a recurring challenge: companies need to confirm that reported vulnerabilities have actually been resolved.
For OpenAI, progress could be demonstrated through independently verified fixes and repeated tests of its internal access permissions.
Here’s another reason OpenAI’s security push is worth watching.
The same AI capabilities that help researchers discover vulnerabilities can potentially help attackers find them, too. Cathedral’s experience with Anthropic shows how AI agents can accelerate the search for weaknesses in connected apps. For companies holding valuable AI research, the consequences could extend well beyond ordinary business records.
An attacker who gained access to sensitive model research might learn proprietary techniques or development plans. Someone who compromised customer-facing systems could potentially obtain confidential business information.
The risks also increase as AI agents gain access to more internal tools.
As The Neuron previously explained, OpenAI’s earlier agent-security incidents showed how AI systems could exploit unexpected connections between tools and shared infrastructure.
For businesses that use ChatGPT or other AI services, these developments raise questions about how providers protect internal information and connected apps. It also pressures security teams to investigate vulnerabilities faster, since attackers may have access to increasingly capable AI tools themselves.
Advertisement
OpenAI’s partnership with Cathedral could help it find vulnerabilities that its internal teams have overlooked. The company has already assigned engineers to security work and increased rewards for researchers who report serious flaws. But Reuters’ investigation raises questions about why employees reportedly struggled to get security concerns addressed years earlier.
External researchers can identify vulnerabilities. OpenAI still has to decide how quickly to fix them, which employees should retain access to sensitive information, and how frequently its systems need to be tested.
And while the company may be unable to disclose every vulnerability publicly, it could still provide evidence that its security work is producing results. The real test will be whether OpenAI can show that its defenses have improved, especially in the areas employees reportedly warned about for years.
If Cathedral finds problems, will OpenAI fix them and independently verify that those same weaknesses can no longer be exploited?
Source: The Neuron
