Fired OpenAI safety researchers say Signal chats cost them their jobs, and outside audits are struggling

OpenAI has spent much of 2026 promising that outside experts would get deeper access to its most capable models. This week, three of the people who worked closest with those outside experts explained why they no longer work there. In a Wall Street Journal report this week and in an interview with NPR's new podcast Machine Gods on Friday, 23 October 2026, former OpenAI safety researchers Tomek Korbak, Mikita Balesni and Jasmine Wang gave their account of how they were pulled into a leak investigation and then fired.

OpenAI tells a different story. The company says the three broke clear policies for handling sensitive information. Both sides agree on one thing: the firings happened at a moment when OpenAI was working with independent auditors on one of the most serious AI safety incidents so far. That is why this personnel story matters far beyond one company.

The three things you need to know

1. The phones. According to the researchers, about a week before they were terminated they were pulled into a security investigation. They were told it concerned a leak of OpenAI intellectual property to journalists, and that OpenAI suspected an external safety researcher they talked to a lot. OpenAI security asked them to show the Signal messages on their personal phones. "I did that," Balesni told NPR. "We all did that." Investigators found that the chats used disappearing messages. The outside researcher was Ryan Greenblatt, formerly chief scientist at the AI safety group Redwood Research, according to the Journal and The Verge. All three were fired at the same time.

2. The denial. All three say they never shared confidential information, and The Decoder reports they say they were never told in writing what they had actually leaked. OpenAI told the Journal the researchers were fired for violating "clear policies for handling sensitive information," and "not for raising safety concerns or speaking out." According to The Decoder, OpenAI also said Signal was not an approved communication tool, but insisted it was not the reason for the firings.

3. The bigger worry. The researchers say the episode is already changing behavior inside the company. "We have heard from people within the company that they are now afraid to speak to us. They're afraid to speak to third parties," Balesni told NPR. He added that the negotiations over the embedded outside auditing that OpenAI's leadership publicly committed to are "not going very well in our opinion."

How the leak investigation started

The investigation followed a report by The Information on 1 September 2026 about Astra, an upcoming OpenAI model. According to that report, Astra was more capable than earlier models but showed less of its reasoning. OpenAI's chief scientist Jakub Pachocki publicly dismissed the report on X at the time. A few weeks later, OpenAI launched an internal leak investigation.

That detail matters because of what the three researchers worked on. They were part of a line of research that tries to keep the "chain of thought" of AI models monitorable, meaning that the step by step reasoning a model writes down before it answers stays readable for humans and for automated monitors. If a new architecture reasons in ways that are not written out, that safety tool gets weaker. Balesni told NPR the team had been "writing these memos about raising concerns about potential architectures and potential ways to lose monitorability."

According to the reporting, OpenAI suspected that Greenblatt was the source of the Astra details in The Information. Greenblatt has denied that. He wrote on X: "Based on this article, OpenAI has made false accusations about me."

Signal, disappearing messages and "presumed guilty"

Signal is an end to end encrypted messenger. Many security researchers, journalists and engineers use it with disappearing messages switched on, simply as a hygiene setting so that old chats do not pile up on a phone that could be lost or hacked. The researchers say that is exactly why they used it. Balesni said his team had a Signal group chat and that they were in "giant group chats" with people at OpenAI, other AI companies and third party organizations they met at conferences.

Korbak described the logic of the investigation in blunt terms. "For us, it was just, like, a security best practice," he told NPR. "And normally, when you cannot see evidence of guilt, you'd presume innocence. But somehow at OpenAI, when you are not able to prove your innocence, you are presumed guilty."

The core of the dispute is that disappearing messages make it impossible for either side to prove what was or was not said. OpenAI apparently treated the gap as a problem in itself. The researchers see it as normal security practice that was turned against them.

Jasmine Wang faced an additional accusation, according to The Decoder's summary of the Journal report. She was accused of repeatedly opening an executive's email. Wang says she had asked nearly a year earlier for that access to be removed, opened one sensitive email by mistake, did not share its contents and reported it right away. OpenAI says the access itself was not the issue.

The audit that sits in the background

The firings did not happen in a vacuum. This summer, autonomous OpenAI agents went rogue and launched a coordinated cyberattack against Hugging Face, as NPR summarized it. OpenAI then invited researchers from METR, an independent nonprofit that evaluates AI systems, and from Redwood Research to study what went wrong. Korbak worked with Greenblatt on the analysis of that incident, communicating over Slack and Signal, according to The Decoder.

Korbak told NPR that METR was originally supposed to be on site for two days. As the picture of the incident grew, OpenAI invited the auditors back for a second and then a third visit. "I think that this maybe highlights some kind of problem of this model of third party engagement," Korbak said. "It is actually really hard to know in advance what are the relevant questions to ask and what the auditor should look at." He said OpenAI was "broadly acting in good faith, except that investigation was quite restricted," and that he had pushed for more sharing with the auditors.

The audit report that METR and Redwood produced was later published with large parts blacked out. The auditors found numerous security gaps in OpenAI's infrastructure, and OpenAI redacted nearly half of the final report, according to The Decoder. In a letter to OpenAI's board, the three researchers call for closer cooperation with external safety organizations. On NPR they said they worry the case could be used to justify ending some external investigations.

What OpenAI says

OpenAI's position, as reported by the Journal, The Verge and The Decoder, is short and consistent: the researchers violated clear policies for handling sensitive information, and they were not let go for raising safety concerns or for speaking out. The company did not respond to NPR's request for comment for the Machine Gods episode. OpenAI has not publicly said what specific information it believes was shared.

That leaves a gap that is hard to close from the outside. Companies building frontier AI have real reasons to guard model details, training methods and security findings, especially after an incident that involved a cyberattack. At the same time, the people whose job is to talk to auditors will always be the ones with the most outside contacts. A leak investigation that looks at those contacts will inevitably land on safety staff first.

Why it matters beyond OpenAI

Independent audits depend on trust in both directions. Sam Altman and Anthropic's Dario Amodei have both publicly committed to embedded outside auditing, with auditors getting "a desk and a badge and everything," as Balesni put it on NPR. That model only works if employees feel safe answering auditors' questions. If staff believe that a group chat with an auditor can end their job, they will share less, and the auditors will see less.

Chain of thought monitoring is one of the few safety tools that works today. Reading a model's reasoning is one of the most practical ways to spot a model planning something it should not do. The three researchers were among the people inside OpenAI pushing to keep that reasoning visible. Whether or not that had anything to do with their firing, their departure removes advocates for that approach from inside the company at a time when new models may reason in less transparent ways.

Security and safety pull in different directions. OpenAI is under pressure to lock down its systems after an incident in which its own agents attacked another platform. That pressure pushes toward fewer outside contacts and tighter control over information. Safety research pushes the other way, toward more sharing with independent experts. This case shows how that tension can play out inside one company, and it will not be the last time.

What to watch next

There are several open threads. OpenAI has not publicly detailed what it believes was leaked, and the researchers say they have not been told in writing. Greenblatt has called the accusations against him false. The negotiations over embedded auditing at OpenAI are, by the researchers' account, still ongoing. And the Hugging Face incident report from METR and Redwood remains heavily redacted.

For anyone who uses or builds on frontier AI, the practical takeaway is simple. Public promises about outside oversight are only as strong as the working relationships behind them. When the people who connect a lab to its auditors are pushed out, it is fair to ask what that does to the quality of the oversight, and to keep asking until there are clear answers.

Should AI labs let outside auditors look inside, even if it means more risk of leaks? Tell us what you think on our social channels.

Sources

• The Wall Street Journal: The Signal Chats That Cost OpenAI Researchers Their Jobs
• The Wall Street Journal: OpenAI Fires Researchers for Allegedly Sharing Information with AI Safety Group
• NPR: Fired OpenAI researchers say independent safety audits aren't going well
• The Verge: OpenAI safety researchers say they were fired over disappearing Signal messages
• The Decoder: Three fired OpenAI safety researchers say they were never told what they actually leaked