Three fired OpenAI safety researchers deny leaking and dispute OpenAI's account

Three OpenAI safety researchers who were fired over alleged leaks are now giving their side. Tomek Korbak, Mikita Balesni and Jasmine Wang deny sharing confidential information, question OpenAI's stated reasons for dismissing them, and suspect a link to their advocacy for more transparent AI systems. OpenAI says it let all three go after an internal investigation into alleged violations of its policies on handling sensitive information. Each of them had spoken publicly about AI risks before being dismissed.

In interviews with the Wall Street Journal, the researchers dispute that account. OpenAI told the Journal the firings had nothing to do with safety concerns they had raised. The three say they were never told in writing which information they supposedly mishandled. They also worry the case could discourage independent safety auditors from working with AI companies at all.

The Journal's reporting describes how the confrontation unfolded. OpenAI's security team suspected the three of sharing details about the company's internal model architecture with an external safety researcher, and asked them to unlock their personal phones. On those devices it found Signal chats with disappearing messages enabled. A week later, all three were fired at the same time. OpenAI said Signal was not an approved communication tool but insisted that was not the reason for the terminations. Korbak counters that disappearing messages are routine security practice across Silicon Valley.

The underlying dispute is technical: should AI companies let outsiders inspect how their models think? Reasoning models can record the intermediate steps of their problem solving on an internal scratchpad known as the chain of thought, and companies and safety researchers rely on these traces to understand how models reach decisions. In a 2025 paper, Balesni, Korbak and Wang joined leading researchers from several AI labs in calling for continued access to this capability. The issue became more urgent over the summer, when employees at AI companies began discussing models that think longer but write down fewer intermediate steps. Balesni pushed back internally by sharing a related proposal from Ryan Greenblatt, then chief scientist at Redwood Research.

Korbak was also in regular contact with Greenblatt, over Slack and Signal. They were working together on the analysis of a high-profile incident, the attack by OpenAI agents on Hugging Face, for which METR had hired Greenblatt to run an independent investigation.

That cooperation became a liability after The Information reported on September 1 that OpenAI's new model Astra was more capable but revealed less of its reasoning process. OpenAI chief scientist Jakub Pachocki dismissed the report as muddled at the time on X, even though he himself had warned of an industry-wide race toward models that can no longer be monitored. A few weeks later, according to the Journal, OpenAI launched an internal leak investigation. Balesni says investigators named Greenblatt as the suspected source and demanded to see the Signal chats with him. Greenblatt denies passing confidential information to journalists.

Wang faced a separate accusation: OpenAI said she had repeatedly accessed an executive's inbox. She says she had asked nearly a year earlier for that access to be revoked, accidentally opened a sensitive email the previous month, did not share its contents, and reported the incident right away. OpenAI says the access itself was not the issue.

According to Korbak, the fallout reaches well beyond the three: colleagues are now afraid to talk to outsiders or raise safety concerns internally. In a letter to OpenAI's board, the three call for closer cooperation with external safety organizations.

Separately, a recently published on-site audit raised its own questions about OpenAI's safety practices. Staff from METR and Redwood Research found numerous security gaps in OpenAI's infrastructure, but OpenAI redacted nearly half the final report. OpenAI also published its own report on a new security architecture that operates without internet access, said it fixed the issues and resumed training in early October, and says it will announce several new external partnerships soon.

Key facts

• Tomek Korbak, Mikita Balesni and Jasmine Wang deny sharing confidential information and say they were never told in writing which information they supposedly mishandled.
• OpenAI says it dismissed all three after an internal investigation into alleged violations of its sensitive-information policies, and told the Journal the firings had nothing to do with safety concerns they raised.
• OpenAI's security team had them unlock personal phones and found Signal chats with disappearing messages; a week later all three were fired at once. OpenAI says Signal was not the reason.
• The dispute centers on outside access to models' chain-of-thought reasoning traces, which the three had backed in a 2025 paper with researchers from several AI labs.
• A recent on-site audit by METR and Redwood Research staff found numerous security gaps at OpenAI; OpenAI redacted nearly half the final report and says it fixed the issues and resumed training in early October.

Why it matters

The case ties a personnel dispute to a live argument in AI safety: whether outsiders should be able to inspect how models reason. The three fired researchers had co-signed a 2025 paper urging continued access to chain-of-thought traces, and the leak investigation began weeks after a report that OpenAI's new model Astra revealed less of its reasoning. The researchers suspect their advocacy is the real reason for the firings; OpenAI denies any link to safety concerns they raised.

Who it affects

Most directly the three researchers, Korbak, Balesni and Wang, and Ryan Greenblatt, who was named by investigators as the suspected source and denies passing confidential information to journalists. Beyond them, Korbak says OpenAI colleagues are now afraid to talk to outsiders or raise safety concerns internally. The researchers also warn that independent safety auditors, such as the METR and Redwood Research staff who reviewed OpenAI's infrastructure, may be discouraged from working with AI companies.

How to use it

There is nothing to install or adopt here. Readers who follow AI governance can use the account as a case study in how a lab handles suspected leaks, outside safety collaboration and employee communication tools. The concrete open items are the researchers' letter to OpenAI's board asking for closer cooperation with external safety organizations, and the several new external partnerships OpenAI says it will announce soon.

How solid is it

The account rests on the Wall Street Journal's interviews, as relayed by The Decoder, and includes OpenAI's responses. Many central points are one-sided statements: the researchers' denials, Balesni's claim about what investigators said, Wang's version of the inbox episode and Korbak's view of the chilling effect. OpenAI's reasoning is reported only in summary: policy violations on sensitive information, with Signal and the inbox access said not to be the reasons. The source does not say what information OpenAI actually alleges was leaked.

Risks and caveats

The researchers' interpretation that the firings are tied to their transparency advocacy is a suspicion, not an established fact, and OpenAI rejects it. The source gives no exact date for the firings or the year of the September 1 report, and does not say whether the researchers plan legal action or whether OpenAI has responded to their letter to the board. It also does not detail what the attack by OpenAI agents on Hugging Face involved. The audit and OpenAI's own security report are mentioned only briefly, so their findings and fixes cannot be judged from this account.