Last week, OpenAI announced the dismissal of three employees on the grounds that an internal investigation found that the three had violated the company's rules on access to and processing sensitive information and allegedly shared confidential information with a third-party AI security assessment organization outside established procedures.
They are Jasmine Wang, who works on model alignment; Tomek Korbak, who works on AI security research and has been involved in technical communication between OpenAI and external security assessment agencies; and Mikita Balesni, who works on AI security and model alignment research.
In an open letter to OpenAI leadership this morning, Mikita Balesni said, "We were fired because we put AI security above OpenAI's short-term interests as a company".
Jasmine Wang said, "The company fired me for one reason only: to visit an executive's mailbox. I want to make it clear that in the history of OpenAI, too many people have left suddenly, and the truth behind it is always covered up by various rhetoric".
Tomek Korbak says, "I've been raising a security concern over the last few months: we're losing the ability to monitor AI Agent thinking processes. And this ability to monitor is one of the most effective ways we've found that AI behaves abnormally. I think that's why I'm really fired. Now I'm worried that OpenAI will dismiss us as an excuse to reduce our cooperation with external auditors METR (Model Evaluation and Threat Research)".
The following is the full text of the three researchers' public letters, which reveal details previously unknown to the outside world.
OpenAI cannot ensure AI security on its own
Security and Security Committee, Security Advisory Group and Mission Advisory Council:
We are the three security and coordination researchers who were fired by OpenAI last week: Tomek Korbak, Jasmine Wang and Mikita Balesni. We write this letter to you because you are responsible for overseeing OpenAI's security work.
We are increasingly concerned that the internal and external communication surrounding this dismissal has frightened former colleagues who are beginning to lose the courage to speak and work as they did in the past, and these practices were an integral part of OpenAI's day-to-day work until last week.
In the past, we have been able to publicly raise security concerns and express our differences. Companies have also encouraged us to collaborate with independent security agencies to conduct research with the expertise of external experts. This is why OpenAI was so different and why we are so proud to have joined this team.
AI is not an ordinary technology, and OpenAI is not an ordinary company. Those of us who are involved in security research often discover risks earlier than others. To figure out how to deal with these risks, we have to work closely with outside experts. To be able to do this with confidence, without fear of being punished, while having a clear internal process to support the work involved, which is itself a vital security mechanism.
We believe that the path to superintelligence is not safe if the researchers closest to risk are unable to continue to build high levels of trust and full communication with each other and with third-party institutions.
We wrote this letter to defend this culture. Some of our correspondents may not know about us. In fact, all three of us have been working in the field of AI security for years.
Tomek Korbak began his research on how to use reinforcement learning to achieve language model alignment in the GPT-2 era, and completed his PhD thesis thereafter. After joining OpenAI, he majored in research on chain-of-thought monitoring, co-authored OpenAI's security strategy, and participated in the analysis of the underlying causes of the decline in chain-of-thought monitoring in Astra-class models. During the Hugging Face incident investigation, he was a technical liaison between OpenAI and METR.
Jasmine Wang participated in the writing of the Trustworthy AI Development report during her 2019 internship with the OpenAI Policy Research Team. Later, she led a team at the UK AI Security Institute (UK AISI) and returned to OpenAI in 2025 to co-manage the Safety Cases project. She also proposed the concept of "Pacing, which was later popularized by the "Pacing the Frontier" petition.
Mikita Balesni was one of the founding members of Apollo Research in 2023, which focuses on the problem of AI misalignment, and was one of the first researchers to notice that AI is beginning to realize that it is being evaluated. At OpenAI, he has been involved in the field of misalignment assessment, misalignment science and mind-chain monitoring, as well as Hugging Face.
Prior to joining OpenAI, the three of us co-authored a cross-industry position paper, two of which were lead authors, called Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety.
One, about our firing.
For us, OpenAI is far from just a job. Its mission has always been a very important part of our lives. During our work, we always follow the company's mission and the working norms of the company at the time.
However, this dismissal has raised concerns that the working norms within OpenAI are changing and that employees are no longer aware of what can be done and what will touch the red line. Given the significant security risks that exist during the development of AI, we cannot allow employees to work in an environment full of fear, rules and ambiguity. Such an environment would hamper AI security research and weaken the ability of third-party institutions to oversee the company.
A sudden dismissal like ours, and the whole process being handled in such an open, sudden way, are having a chilling effect on OpenAI's open culture of pride in the past. If last month is still considered normal work behaviour and this month suddenly becomes the reason for hiring, then every employee at OpenAI will begin to guess where the company's red line is.
We know that there are different versions of this saying in the world today. We want to explain some of these things directly to you.
First, we're not the leakers in The Information's report. The article deals with so-called new, less traceable model architectures. We don't know exactly who leaked the information. And we have no reason at all to leak it. On the contrary, the report undermines the work we've been doing.
The following is a link to the article:
Second, we believe that any contact we have with external agencies does not go beyond the scope of their respective responsibilities. The recipients of this email are well aware that there is no precedent in the Hugging Face investigation, and the relevant internal policies have been gradually developed during the investigation. Tomek has done its best to adhere to the policies of OpenAI at the time, while continuing the practice that the company has followed since its early founding in cooperation with third parties. This investigation is particularly sensitive.
Mikita was also working on similar work at the time. He was in charge of promoting cross-corporate collaboration and striving for a commitment from all parties to prevent the loss of traceability of the model. This work was only possible through extensive communication with external bodies. Mikita coordinated and discussed the work with members of the Board of Directors of OpenAI and company executives at all times. He understood at the time that the work was supported by high levels of OpenAI. Throughout the process, he continued to confirm matters to direct management and carefully remove sensitive information before sharing the material with others.
As for Jasmine, she was granted access to an executive's mailbox because of the need for recruitment and prior authorization. Later, when that permission was no longer needed, she proactively requested the removal. But the IT department did not complete the removal, and Jasmine herself could neither withdraw the permission nor proactively exit the mailbox. Two emails were merged and displayed in her inbox, and the interface did not clearly identify which mailbox each letter originally belonged to.
We feel it is necessary to clarify these things because we value the relationship with our colleagues at OpenAI. At the same time, we are also concerned about the various rumors circulating around the world, including allegations of a co-authored memo addressed to the board.
If it were possible, we would certainly prefer not to be the focus of public attention in this sudden way. Now what worries us most is that the reasons for the dismissal have not yet been clearly explained, that the whole process is so public, and that all the rumours continue to circulate that have made those who are still working at OpenAI feel cold and afraid to speak up.
Two, before we leave, let's give OpenAI three suggestions.
1. OpenAI must deliver on last month's public commitment to allowing third-party security auditors to engage deeply in the company's internal work.
Continuing to collaborate with the entire AI safety ecosystem is vital for OpenAI to achieve its mission. This summer, we participated in the Hugging Face incident investigation, and our collaboration with external auditors was one of our proudest achievements. These efforts helped the outside world to better understand the realities of cutting-edge AI technology.
We are concerned that the company may terminate its partnership with METR on the grounds of our dismissal, or severely restrict access and scope of work for external auditors. We hope that OpenAI will live up to Sam Altman's publicly made promise on September 12th: to allow independent assessors to continue to work in the company and access similar access to internal staff.
2. OpenAI must ensure the traceability of front-end models.
At present, the industry as a whole does not know how to safely develop and deploy models that cannot be effectively monitored. While the traceability of front-end models is declining. As long as we continue to rely on traceability to ensure AI security, OpenAI and other front-end AI companies should not continue to develop technologies that will further weaken model traceability.
We agree with Jakub's previous public statement that the traceability of the mind-chain is "very fragile, and unfortunately the overall trend is going in the wrong direction". We also agree with what he said about "preventing the entire industry from entering a competition to develop untraceable architectures". We still believe that it is important for the entire industry to coordinate on this issue, and we hope that OpenAI can support its employees in driving this work.
3. OpenAI must continue to support a culture of open, transparent discussion that enables internal security researchers to communicate with the entire AI security ecosystem.
We urge OpenAI to publicly reaffirm its commitment to a culture of transparency and openness so that employees can safely raise concerns both inside and outside the company.
Researchers within OpenAI are the first line of defense against major problems. Open culture has been an important feature of the company since its inception. This culture must be preserved. We also urge OpenAI to clarify how employees should work with external security agencies so that people no longer have to guess where the boundaries of those ever-changing rules are.
To encourage discussions within the company, we hope that this letter will be widely circulated within OpenAI. Although we are no longer a member of OpenAI, we still have great respect for our colleagues who have worked with us in the past. We hope that they can continue to urge OpenAI to stick to its mission.
The following is a link to the article: