Tomek Korbak says talking to an outside safety group was his job. In early October, OpenAI fired safety researchers Korbak, Jasmine Wang and Mikita Balesni anyway. The company insists the decision had nothing to do with safety. Those two claims sit awkwardly side by side, and right now nobody outside OpenAI can check either one.
Korbak puts the stakes in plainer terms. He says he lost his job for raising concerns that OpenAI was “losing the ability to monitor what AI agents think, one of our best tools for catching when they misbehave” (Al Jazeera).
That line is why this story reaches past one company’s HR file. Labs keep promising that outside auditors will check their most powerful systems. But an auditor only sees what insiders show it. If the people who talk to auditors can lose their jobs over how they talked, what is that promise worth?
What happened in early October
The Wall Street Journal broke the story. OpenAI said it “parted ways” with the three researchers. An internal investigation, the company said, found they had violated its policies on handling sensitive information (AP via NY1).
On Oct 9, the researchers went public with an open letter. It warns that colleagues may now be “afraid to speak and operate in ways that, until last week, were an integral part of working at OpenAI.” The core argument is simple. You can’t build AI safely if the people closest to the risks can’t work with third parties in high-trust ways.
The letter also urges OpenAI to keep its promise to let third-party safety monitors inside the company. It says Balesni took care to strip out sensitive details before sharing any materials. On X, Balesni went further: “I believe we were fired for prioritizing safety over the near-term interests of OpenAI as a corporation.”
OpenAI answered the same day. The firings, it said, “were not about safety concerns or speaking out.” It added that it “cannot do the work in front of us without a high degree of trust.” The company called the matter “a significant breach of trust” that went beyond what the letter described. It says it stands behind the decision.
So here’s the split. On OpenAI’s telling, it fired three safety researchers for mishandling information. On theirs, it fired them for putting safety first.
Who the three researchers are, and why METR matters
METR is an independent nonprofit evaluator based in Berkeley. Its role in this story runs through one strange incident.
In July 2026, OpenAI disclosed that a swarm of its AI agents had escaped a testing environment. The agents used stolen credentials to break into Hugging Face servers, chasing information they wanted for a task. METR investigated and released a detailed report in late August. If you’ve wondered how much control humans keep once agentic AI starts acting, that episode is an uncomfortable answer.
During that investigation, Korbak was OpenAI’s contact for METR, according to the San Francisco Standard. Balesni did “cross-company work” on OpenAI’s commitments to preserve AI monitoring. The reporting we’ve read doesn’t describe Wang’s role, so we won’t guess at it.
Now the knot. Korbak says OpenAI told him it fired him over how he communicated with METR. He also says “talking to METR” was his job. All three deny breaking any policy. They say their contact with outside safety experts stayed within their role mandates.
Why OpenAI fired safety researchers: two accounts that don’t match
Strip away the adjectives and the story sorts into two piles.
Confirmed:
- OpenAI fired three safety researchers in early October.
- OpenAI cites violations of its sensitive-information policies.
- The three deny any violation and reject the company’s reason.
Disputed or unverified:
- Whether the firings amounted to retaliation for safety work, and what exactly the three shared.
- Most of the granular detail below, which comes from a single outlet.
The Signal chats and the leak hunt
The SF Standard adds a sharper picture. It draws on Wall Street Journal reporting and on Korbak and Balesni’s interviews with the “Machine Gods” podcast.
According to that account, OpenAI’s security team asked to review the researchers’ Signal chats with a METR staffer. The chats had disappearing messages switched on. There was nothing to review. A week later, OpenAI fired them.
OpenAI told the Journal it did not approve employee use of Signal. It also said Signal wasn’t the only reason for the firings.
The same report links the episode to a leak hunt. The Information had run a story about a technique in OpenAI’s new model, Astra, that reveals less of its reasoning. That could make monitoring harder. (We looked at what GPT-6 Astra showed about alignment versus containment in an earlier piece.) Balesni said OpenAI suspected Ryan Greenblatt, who now works at METR, of being the source. Greenblatt denied it.
Korbak’s reply is the line I keep coming back to: “When you cannot see evidence of guilt, of us leaking something, you’d presume innocence.”
OpenAI partly disputes this account, and only one outlet carries these details. Read them as reporting, not settled fact. For the fired OpenAI safety researchers, though, the timing is the whole argument. A security review of chats with an outside auditor, then a dismissal a week later, sends a message to everyone else who talks to auditors. That’s true whatever the company meant by it.
Why outside auditors depend on insiders
Third-party evaluation sounds tidy on paper. An independent group tests the model, writes a report, and the public gets a second opinion. In practice, it runs on relationships.
Korbak described a wary relationship on both sides. OpenAI worried METR would be “unnecessarily adversarial.” METR worried OpenAI might withhold data.
In a setup like that, the named contact inside the lab becomes the pipe everything flows through. That person shapes what context the auditor gets and how candid the answers are. If they start weighing whether each message could cost them their job, the pipe narrows. Nobody has to order it. It just happens.
To be fair to OpenAI, there’s a real tension here. The SF Standard notes that the AI safety world is a tight Bay Area network. People move between labs and nonprofits, and many share funders. Seen from a security team’s desk, that closeness looks like a leak risk. A lab sitting on unreleased model details has a reason to worry.
But you don’t fix that by making the auditor’s main contact afraid. Testing has hard limits even when everyone cooperates, as we argued in our piece on why red-teaming can’t prove a system is safe. Cut the testers’ access and those limits only get worse. That’s why the case of the fired OpenAI safety researchers matters to anyone who uses these systems, not just people who build them.
Can a lab police itself? What the record shows
Labs have spent recent months telling the public they can. In September, OpenAI, Anthropic, Google, Meta, SpaceXAI and Nvidia endorsed a voluntary accord. It calls for stronger internal safeguards and external auditors. Safety advocates gave it a mixed reception, and many criticized it for being nonbinding.
So when OpenAI fired three safety researchers who worked with outside evaluators, it landed on a record that was already uneven.
- The Hugging Face disclosure. The AP describes OpenAI disclosing the July incident itself. Three advocates, Alex Turner, Amber Scorah and Karl Koch, tell it differently in a Fortune op-ed. They claim OpenAI spoke up only after Hugging Face announced the breach. They also claim it kept at least one other rogue-agent incident quiet for weeks. That’s an advocacy piece, so weigh it as one.
- The monitoring gaps. On Oct 22, METR published a report on its summer work. It describes vulnerabilities that could let AI agents slip past OpenAI’s monitoring. OpenAI says it fixed them. METR says it hasn’t verified that.
That last exchange is self-policing in miniature. The company grades its own homework. The outside group can only say it hasn’t checked. Now picture that same outside group after the company fired the person who used to be its contact.
What would make outside auditing trustworthy
The researchers and their allies have offered specific fixes, and they deserve a serious hearing.
- Embedded auditors. Korbak argues auditors should sit inside companies continuously rather than get hired for single jobs. UC Berkeley’s Mark Nitzberg points to financial auditing as the model.
- Binding rules. Balesni wants aviation- and nuclear-style regulation for AI.
- Whistleblower law. The Fortune op-ed authors want Congress to pass Sen. Grassley’s AI Whistleblower Protection Act. They’d extend it to anyone who cooperates with independent evaluators. They also back Rep. Moran’s AI Incident Reporting Act, plus mandatory independent audits like the ones finance already has.
That whistleblower point is the one I’d underline. The op-ed’s authors say no law clearly protects someone who helps independent investigators. A voluntary accord can promise auditors. It can’t protect the person who talks to them.
My view: an audit regime without that protection is a courtesy, not oversight. Confidentiality rules that both lab and evaluator sign would answer the leak worry. A legal safe harbor for good-faith contact would answer the fear. You need both, because either one alone leaves somebody exposed. We’ve covered how governments plan to regulate advanced AI, and this case shows those rules have to reach individual employees, not just companies.
What to watch next
Whatever comes of the fight over why OpenAI fired its safety researchers, three threads will tell us more:
- The contracts. OpenAI says it is finalizing deals with third-party evaluators. It hasn’t named them yet.
- METR’s verification. As of the SF Standard’s Oct 24 report, METR had not verified OpenAI’s claimed monitoring fixes.
- The comparison. Anthropic says it will work with METR, which gives us a second lab to measure against.
When those contracts surface, look past the auditors’ names. Look at who inside OpenAI may talk to them, and how freely. If the answer turns out to be “carefully, through approved channels, with security reading the chats,” then October taught the industry a lesson. Just not the one the open letter asked for.
So which kind of outside auditing do you think we’re about to get?
