OpenAI Safety Researchers Fired Over Signal Chats
Read what is known about OpenAI’s safety researcher firings, the Signal leak inquiry, Ryan Greenblatt’s denial, and the questions it raises for AI governance.
OpenAI's Signal Investigation Raises Hard Questions About AI Safety
OpenAI fired three safety researchers after an internal investigation into a possible leak, according to The Wall Street Journal. The inquiry reportedly involved security staff asking the researchers to unlock their personal phones and reviewing Signal messages involving AI safety researcher Ryan Greenblatt. Greenblatt denies leaking confidential information, and the three former employees say they did not share company secrets outside OpenAI. OpenAI says the investigation found policy violations.
Those are the competing accounts. The Next Web has not independently verified the underlying facts, and the public reporting doesn't spell out what information was shared, which policies applied, or why each employee was dismissed. That uncertainty matters here. This isn't just an internal personnel dispute - it touches information security, employee trust, and a live debate about how AI companies should handle safety concerns and requests to examine model behavior.
What happened in OpenAI's leak investigation
The reported investigation followed a September 1 story in The Information about Astra, OpenAI's latest model. That piece said Astra used a new technique that increased capability while showing less of its reasoning. OpenAI chief scientist Jakub Pachocki called the reporting "confused," according to coverage. Still, the claim fed a wider argument about whether advanced AI systems should disclose more of the intermediate reasoning behind their outputs.
According to The Wall Street Journal, OpenAI's security team reviewed the personal phones of three safety researchers during the leak inquiry. Investigators reportedly suspected Greenblatt, a safety researcher who had previously led research at Redwood Research and was then working at METR. The researchers had Signal conversations with him, and security staff reportedly found that some messages were set to disappear.
The three people named in the reporting are Tomek Korbak, Mikita Balesni, and Jasmine Wang. The Wall Street Journal reports that OpenAI held meetings with them at the same time and dismissed them. It first reported the firings on October 1. Korbak said he was told there had been a "breach of trust" because he interacted with a third party through channels the company had not approved.
As of now, the available reporting doesn't show that the Signal conversations included confidential information. The researchers say they did not disclose it. OpenAI says its internal investigation found that they violated policies covering sensitive information. In other words, the statements don't add up to a resolved account of what happened.
The timeline, as reported
The sequence matters, but it's also easy to overread. The coverage connects the company's investigation, the firings, and the public debate about model reasoning - but that doesn't guarantee they were the same issue:
- September 1: The Information reports on Astra's capabilities and the visibility of its reasoning.
- After the report: OpenAI investigates a suspected leak and reviews the researchers' communications, according to The Journal.
- The following week: Korbak, Balesni, and Wang are reportedly called into meetings and dismissed.
- October 1: The Journal reports the firings. The researchers' accounts and Greenblatt's response make the dispute public.
This timeline shouldn't be taken as proof that the dismissals were retaliation for safety advocacy. OpenAI explicitly denied that. But given the timing - and the fact that the researchers worked on safety questions - it's also reasonable to ask how the company separates enforcement of information-security rules from disagreements about policy or research direction.
The competing accounts of the firings
OpenAI told The Wall Street Journal that its internal investigation found the three researchers violated company policies on sensitive information. OpenAI said the firings were "not for raising safety concerns or speaking out." A spokesperson also said Signal was not an approved channel, while noting that Signal wasn't the only basis for the dismissals.
The researchers describe a different story. Korbak and Balesni say leaders pointed to disappearing messages as the reason. All three say they didn't share confidential information outside the company. Korbak described disappearing messages as a basic security practice. That view is common in parts of the tech industry, where encrypted messaging is used to reduce exposure of sensitive conversations. Still, that doesn't automatically settle whether their use fit an employer's specific rules.
Wang's account is separate from the Signal issue. She says she was told she repeatedly opened an executive's email. She adds that she had asked the company to remove her access almost a year earlier, accidentally opened one sensitive email in the month before her dismissal, and reported the mistake right away. OpenAI reportedly said it didn't object to the access itself. That's a different allegation than the Signal use, and the available reporting doesn't connect it clearly to OpenAI's findings.
Greenblatt's denial
Greenblatt says he takes confidentiality seriously and doesn't share confidential information with reporters. After the story was published, he wrote on X that OpenAI made "false accusations" about him. He said the researchers were told he helped leak architecture details to The Information, which he denies.
Greenblatt also acknowledged that a journalist from The Information contacted him before publication. He says he didn't comment on the reporting, except for one request related to a blog post of his. He also denies reading an internal memo that included sensitive architecture details. His version is that he saw an edited version without sensitive information - one that OpenAI approved for him to review - and that the company may have mixed up documents.
On the Signal chats, he says the messages were with professional contacts and that Signal is common in tech. A journalist contacting him and the existence of private messages doesn't, by itself, prove confidential material was shared. Likewise, a denial doesn't independently prove what happened. The core evidence and OpenAI's investigative conclusions aren't available in the reporting summarized here.
For readers trying to make sense of the dispute, the key distinction is between how people communicated, what information was shared, and what they intended. Using an unapproved channel doesn't automatically mean someone leaked confidential information. A company can have legitimate reasons to investigate a possible disclosure. And reviewing personal devices is its own process question - one that depends on consent, scope, and procedure. Treating all of that as one blended issue makes it harder to fairly evaluate either side.
Why Signal and disappearing messages became central
Signal is an encrypted messaging service that can make messages disappear after a set period. Those features can reduce how long sensitive conversations remain stored on a device. They can also make later review harder. On their own, those facts don't determine whether someone's use was appropriate, compliant, or improper.
That distinction matters in a company building high-stakes AI systems. Teams need to protect unreleased research, model details, security findings, and customer information. At the same time, researchers may need to talk with outside peers, auditors, or safety organizations. If the rules around those conversations are unclear, people can walk away with different assumptions - and a post-incident investigation can become the first time the company's expectations get spelled out consistently.
The security trade-off
Operationally, the question isn't just whether disappearing messages are "secure." Security depends on the threat model and what information is involved. A setup that lowers the risk of an old phone exposing past messages may also make it harder for an organization to keep records it later needs for an audit or investigation.
A workable policy usually has to cover things like:
- Approved channels: Which tools employees can use for internal work, external experts, and sensitive discussions.
- Information classifications: What can be shared, with whom, and under what conditions.
- Retention expectations: Which records must be kept for legal, security, or research review.
- Exceptions and escalation: How employees request approval or report accidental exposure without confusion.
- Investigation boundaries: What devices or accounts may be reviewed, who approves access, and how the review is documented.
Those controls only help if employees can actually understand them and use them day to day. A policy on paper that doesn't match the tools and training people rely on isn't a reliable control. And a convenient messaging app isn't automatically acceptable for every business conversation just because many professionals use it.
The reported phone checks also raise another issue: access to a personal device is a high-trust action. Organizations need a clear basis for requesting it, a limited scope, and a record of what was examined. The reporting doesn't describe the exact process used here, so it's premature to say whether the review itself was appropriate.
The wider stakes for AI safety and governance
This dispute lands amid a real disagreement about how much of an AI model's reasoning should be visible to others. The three researchers had spent the summer pushing for more access to chain-of-thought - the written scratch work a model may generate while solving a problem. In an October letter to OpenAI's board, they urged OpenAI to work with outside safety groups, according to The Journal.
None of that means every internal reasoning trace should be published. There are real trade-offs. More visibility can help researchers investigate model behavior and spot failures. But detailed reasoning can also create security, privacy, or misuse risks. And a model's written explanation isn't always a complete or faithful account of what actually happened inside the system. The right level of access depends on the research question, the model, and the safeguards around any shared data.
The governance question is who weighs those trade-offs - and who gets to challenge the decision. If safety teams can't raise concerns through a credible process, companies may miss useful evidence. If sensitive information moves through channels that aren't controlled, organizations may lose the ability to protect systems and investigate incidents later. A good process has to manage both risks instead of pretending one can be ignored.
What organizations can take from the case
If nothing else, this looks like a reminder that policy, tooling, and culture have to line up. For AI developers - and any organization managing sensitive research - a practical response is to make expectations explicit before a dispute happens:
- Separate safety escalation from media contact. Give employees clear internal and independent routes for raising concerns. Spell out what they can share externally instead of relying on informal assumptions.
- Make approved communication tools actually usable. If a company bans a channel, it should offer alternatives that support the work - including secure conversations with authorized external reviewers when appropriate.
- Document access and retention rules. Spell out which records must be kept, how long they're retained, and when disappearing messages are off-limits.
- Run proportionate investigations. Define who can authorize device review, what the review may cover, and how evidence is handled. Then apply the same process consistently.
- Protect good-faith reporting. Security investigations should be able to detect policy violations without making employees assume that raising safety concerns will cost them their job.
These steps won't prevent conflict, but they usually make it easier to investigate disputes because the expectations and records exist before people disagree. In practice, that's often the difference between a governance process that survives scrutiny and one that depends on mismatched memories after the fact.
Korbak offered a sharper take on X: "talking to auditors was too much safety, disappearing messages were too much security, and we should have paced ourselves." That's his interpretation, not an established finding. But it captures the tension at the center of the story: safety work needs openness to outside scrutiny, while handling sensitive information requires discipline. Neither goal goes well when the rules are fuzzy or trust breaks down.
Conclusion
The reported OpenAI firings don't yet provide a complete, independently verified account of a leak. OpenAI says its investigation found policy violations. The three researchers say they didn't disclose confidential information, and Greenblatt denies the accusations against him. Much of what would clarify the dispute still isn't in the public record.
What the case does highlight is that AI companies need rules that hold up under stress: clear communication policies, credible safety-escalation routes, proportionate investigations, and careful treatment of personal devices and records. If you work with sensitive AI research, it's worth checking whether your organization has those controls - and whether employees can follow them without having to guess. Read the original report from The Next Web for the source account.