Three OpenAI safety researchers were dismissed on the same day. The detail that would make the story simple, a written description of what they supposedly leaked, is still missing on their account. Tomek Korbak, Mikita Balesni, and Jasmine Wang say they did not share confidential information. They also say the company never told them, in writing, which information they were supposed to have mishandled.
Most companies will never sit inside a lab leak review. They will buy AI agents that send email, touch customer records, and take actions a person used to own. The fight under this personnel story is a control you already understand. Can you see the workpapers, or only the invoice?
The account of the firings comes from Wall Street Journal interviews, reported by Manuel Uth in The Decoder on October 24, 2026. OpenAI told the Journal the dismissals had nothing to do with safety concerns the researchers had raised, and that Signal was not why they were let go. Those two statements do not conflict. They also do not name the information that supposedly crossed the line. What follows is that reported account. It is not a finding a buyer should treat as settled. Each of the three had spoken publicly about AI risk before being let go. That is context. It is not, by itself, a cause.
A timeline, before the theory
The dates are scattered across interviews, a news report, and a separate technical post. Lined up, they are less mysterious than they sound. They still do not prove a motive.
- 2025. According to The Decoder, Balesni, Korbak, and Wang joined researchers from several labs in a paper calling for continued access to chain-of-thought monitoring.
- Over the summer. The same reporting says employees at AI companies were discussing models that think longer and write down fewer intermediate steps. The year is not specified. Balesni pushed back inside OpenAI by sharing a related proposal from Ryan Greenblatt, then chief scientist at Redwood Research.
- July 21 to August 11, 2026. One employee from METR and one from Redwood Research worked on site, stress-testing OpenAI’s internal agent-monitoring system as it stood on July 21. METR published that account on October 22. The post does not discuss these firings.
- September 1. The Information reported that a newer OpenAI model, Astra, was more capable and showed less of its reasoning, according to The Decoder’s account of that story. Chief scientist Jakub Pachocki rejected the report on X. The Decoder also says he had already warned of an industry race toward models that can no longer be monitored. Rejecting one story is not the same as dropping that warning. The warning does not prove the Astra report was right.
- A few weeks after September 1. The Journal reported that OpenAI opened a leak investigation. The researchers say that, a week after investigators looked at their phones, all three were fired at once. No public document pins the firing to a calendar date beyond that.
The researchers suspect the dismissals were tied to their argument that outsiders should still be able to read how reasoning models think. OpenAI rejects that link. Treat the connection as their suspicion. It is not a finding. A reported sequence does not show you what the investigation looked like from the inside.
What each denial actually answers
On the researchers’ account of the probe, OpenAI’s security team suspected them of sharing details of the company’s internal model architecture with an outside safety researcher, and asked them to unlock their personal phones. They say the team found Signal chats with disappearing messages turned on.
OpenAI said Signal was not an approved communication tool, then told the Journal the app was not the reason for the terminations. Korbak’s view, as summarized in that reporting, is that disappearing messages are ordinary security practice across Silicon Valley. Plenty of engineers do treat auto-delete as hygiene. It is also a setting that leaves an investigator with less to read. Neither observation proves a leak.
The outside researcher in that account is Greenblatt. The firing coverage describes Korbak and Greenblatt talking on Slack and Signal while they analyzed an incident involving OpenAI agents and Hugging Face. It also says METR had hired Greenblatt to investigate that incident independently. Balesni says investigators named Greenblatt as the suspected source and demanded the Signal chats with him.
Read the denials against the accusation they answer. The suspected act, as the researchers describe the investigation, was sharing architecture details with Greenblatt, an outside safety researcher. On its face, that is not a call to a reporter. The three say they did not share confidential information at all. Greenblatt denies passing confidential information to journalists. A denial about reporters does not, by itself, answer a question about what an outside researcher was shown. A blanket denial is not a description of the file, the chat, or the rule.
Wang’s case is a separate accusation, and it has the same hole. OpenAI said she had repeatedly accessed an executive’s inbox. She says she had asked nearly a year earlier for that access to be revoked, accidentally opened a sensitive email the previous month, did not share it, and reported the incident right away. OpenAI’s position, as reported, is that the access itself was not the issue. That sentence still does not say what the issue was. Ruling out one theory is not a finding.
If a written account of a real violation existed, it would need four things: which information, which policy, whether it went to an outside researcher or to a journalist, and why Signal was examined if Signal was not the cause. None of that has been made public. Architecture details are not casual reading. An outside researcher in a company’s Slack and on Signal during a sensitive incident is a governance problem even if nobody called a reporter. The gap is that employees, auditors, and customers cannot learn a boundary the company has not specified.
The scratchpad is a procurement issue
A chain of thought is the scratchpad a reasoning model uses while it works: the intermediate steps between a prompt and an answer. Companies use those traces to see how a system reached a decision. Safety researchers want the same window. If a model gets more capable and writes less of that scratchpad down, the window closes as the stakes rise. You are left with a stronger system and a thinner explanation.
That is the argument the three had already made, in the 2025 paper and in Balesni’s internal pushback. It is also the argument a buyer of AI automation should steal, without taking a side in the firing. A model that thinks longer and writes less is a consultant who bills more hours and stops sending the file. Capability goes up. Your ability to challenge the work goes down.
Ask for three numbers. Skip the vibe. What share of agent actions is eligible for monitoring? Eligibility is not the same as a review that actually ran. Can your own security team see reasoning traces, or only the final action? And does an outside assessor get the monitor itself, or a paragraph agreed in advance? You do not have to decide whether three people leaked to ask those questions. You do have to decide whether an AI agent in your stack leaves an audit trail.
What an outside look actually covered
These episodes are easy to mash together. The public record does not let you. METR’s October 22, 2026 post, “Red-Teaming OpenAI’s Internal Agent Monitoring Systems, ” does not name Korbak, Balesni, Wang, Signal, or a leak investigation. It also does not name the Redwood Research employee who worked on site, so that post cannot tell you whether the person was Greenblatt. Separately, the firing coverage says METR hired Greenblatt to investigate an OpenAI-agents incident involving Hugging Face. OpenAI has since published Hugging Face incident and the road ahead, which METR cites as OpenAI’s description of later monitoring changes. METR has not evaluated those claims. Whether the monitoring pilot, the Hugging Face incident, and the leak investigation are one story or three is not established. Using the pilot as evidence for why three people were fired would be a guess.
Read on its own terms, the pilot is still the most concrete public look at how a leading lab watches its own AI agents. It was not a general audit of OpenAI’s infrastructure, and it was not a current bill of health. METR said the exercise was a pilot for deep external access, not a promise of public transparency. The parties agreed in advance to a short, high-level public post. The only explicit redaction METR describes there is a line noting that OpenAI withheld exploit details. A brief summary by prior agreement is not a quiet cut of a longer report.
The figures are METR’s, including the uncertainty it flags. About 75 to 94 percent of agentic internal traffic on the Responses API (the interface those internal agents use to call models) from models at least as strong as GPT-5.5 was eligible for monitoring. METR said that estimate was uncertain in both directions, which is why the range is wide. Of the subset used for internal Codex agents, 99.2 percent was eligible. Eligible means the monitor was allowed to see the traffic. It does not mean every one of those calls was reviewed.
The gap that makes the distinction concrete is compaction: the moment an agent’s running context gets compressed so the work can continue. METR said that not monitoring those events likely left on the order of 10 percent of eligible internal Codex traffic unmonitored between May and July 2026. The precise share was uncertain because those monitor calls had not historically been logged. OpenAI staff had already found the gap and fixed it during the exercise. The monitor, as described, triggered when agents handed control back. While compaction went unwatched, an agent could in principle keep working and stay outside that review. That is a coverage hole, not a parlor trick.
METR says it found novel vulnerabilities in the monitor as of July 21. Those findings describe a historical system. OpenAI was already expanding monitoring while the exercise ran. The pilot did not measure current coverage, and it did not evaluate the changes then in progress. OpenAI has stated that every identified vulnerability affecting the production safeguards stack has been patched. METR’s line is blunt: it has not evaluated that claim. Treat “fixed” as the company’s statement until an independent look says otherwise.
The design lessons are the ones a buyer can use on a vendor call.
- Unmonitored requests should need an explicit yes.
- Monitoring should not wait until an agent hands control back.
- Inference logs and monitor logs should be reconciled, so a missing review is visible.
- Someone should own incident response, with logs the agent cannot quietly edit.
- Agents should not decide whether the monitor runs, and they should not routinely be handed the monitor’s design.
METR pointed readers to an October 14, 2026 note, “Our approach to working with AI companies, ” for how later exercises should handle independence and disclosure. Deep access and a public write-up are different products. A pilot can be one without being the other.
The oversight you inherit when you buy the agent
Korbak says colleagues are now afraid to talk to outsiders or to raise safety concerns internally. That is his reading of the room, not a survey. If he is right, the damage does not stay inside one lab. External reviewers depend on employees who will still take the meeting. A company can answer that fear without conceding the researchers’ theory of the firings. Specifying the boundary would do more for trust than another round of unnamed suspicion.
The three have written to OpenAI’s board asking for closer cooperation with external safety organizations. What the board did with the letter has not been reported. Until something public lands, the practical move sits with the buyer. When an AI agent acts inside your company, you inherit the vendor’s oversight. You do not inherit a rumor about who was fired. Ask to see the workpapers.
Questions worth asking before you pick a side
What were the three researchers told they leaked?
They say they were never told in writing which information they supposedly mishandled. OpenAI has described the issue as a sensitive-information policy violation. The specific finding has not been made public.
Did OpenAI say the firings were about their safety advocacy?
No. OpenAI told the Wall Street Journal the dismissals were unrelated to safety concerns the researchers had raised, and that Signal was not the reason. The link to monitorability advocacy is the researchers’ suspicion. It is not an established fact.
Why should a business care if a model stops writing down its steps?
An AI agent that acts inside your company is only as governable as the record of what it did and why. Chain-of-thought traces are one of the few readable records of intermediate reasoning. If that record thins out, your security team inherits a more capable system and a worse audit trail.
What did the METR exercise actually review?
A three-week on-site pilot, July 21 to August 11, 2026, of OpenAI’s internal agent-misalignment monitor as it stood on July 21. Two people, one from METR and one from Redwood Research. Not a full infrastructure audit, not a leak investigation, and not a current bill of health.
Have the monitoring holes been fixed?
OpenAI says the identified vulnerabilities in the production safeguards stack have been patched. METR has not evaluated that claim. One coverage gap, around unmonitored compaction, was fixed during the exercise itself. Treat “fixed” as the company’s statement until an independent look says otherwise.
What should you ask before you rent the agent?
What share of agent actions is eligible for monitoring, and what share was actually reviewed? Can your security team see reasoning traces, or only the final action? Does an outside assessor get the monitor itself, or a paragraph agreed in advance? Deep access and a public summary are different products.