OpenAI taps product lead Tibo to spearhead security overhaul, with a quarter of engineers reassigned to patch vulnerabilities.

Beating AI News Flash: OpenAI has begun a large-scale overhaul of its internal security, led personally by Thibault Sottiaux (Tibo), an executive in charge of product development. In August of this year, he reassigned about a quarter of the production engineers to focus specifically on patching security vulnerabilities in internal systems.

On November 2, OpenAI announced another round of security testing, partnering with cybersecurity firm Cathedral to use its own models and external security researchers to jointly hunt for system vulnerabilities. At the same time, the company raised its bounty for critical vulnerabilities to more than 4 times the original amount.

The reason for this overhaul is the internal security problems that OpenAI has failed to properly resolve for years. Five people familiar with the matter interviewed by Reuters revealed that even before ChatGPT was released, employees had repeatedly warned management and the board that the company's internal data was accessible to too broad a range of people and that security checks were not strict enough.

At the time, OpenAI kept a large amount of project code in the same repository. As long as employees had access permissions, they could see code from many projects unrelated to their work. Some research materials were also placed on GitHub and Slack, and some internal testing tools even lacked regular security checks. Employees worried that such management practices would make it easier for external hackers, and even foreign governments, to access the company's core technology.

As early as 2023, a data breach occurred inside OpenAI. A hacker breached the company's Slack and stole technical details of the GPT-4 model. OpenAI later explained that the hacker had only entered internal channels accessible to ordinary employees.

In July of this year, three researchers from security firm Hacktron AI also used Anthropic's models to break into the ChatGPT accounts of multiple OpenAI employees and gain access to some internal systems, including the company's code repository.

More widely known is an internal case in October of this year. The U.S. Department of Justice accused a Saudi national OpenAI engineer of installing a hidden recording device in the company's executive meeting room. He had also used internal AI tools to inquire about executives' travel to Saudi Arabia and which executives might attend meetings with Saudi ministers. Justice Department documents also showed that he had maintained contact with a member of the royal family who tried to recruit him to participate in a Saudi AI project.

The successive exposure of multiple incidents has once again drawn attention to the security warnings employees raised years ago. OpenAI previously emphasized R&D speed and information openness more, but now it has begun tightening internal permissions, strengthening security checks, and committing a large number of engineers to patching vulnerabilities.