A recorder hidden in toilet paper exposes OpenAI's long-standing safety issues

The company’s long-term use of a single code repository led to a loss of access control. Although independent repositories have now been set up and a CISO appointed to strengthen reviews, the conflict between security and development speed continues to impact the IPO process.

Author, Source: AIBase

In October this year, an unusual incident was noticed in an OpenAI executive meeting room: someone had secretly placed a recording device. According to a U.S. Department of Justice release on October 13, the individual apprehended was 35-year-old Saudi citizen Abdulrahman Al-Fouzan, who at the time was an OpenAI engineer. The device was cleverly hidden inside toilet paper. Several former employees were not surprised when they heard about this.

Problems had long been brewing, but employee warnings went unheard for years

Reuters, citing five sources familiar with the matter, reported that even before the launch of ChatGPT at the end of 2022, concerns about the company’s security management had been raised to senior management and the board. Some employees felt the leadership prioritized catching up with Google and Anthropic, putting security on the back burner. One source explained that anyone with code access could review large amounts of technical details unrelated to their job—a problem rooted in OpenAI’s long-standing practice of storing most code in a massive system known as a “monolithic code repository.” In the past, this might have been intimidating, but now AI agents can easily organize such vast amounts of information.

The tug-of-war between security and speed is still delaying the IPO

The contradiction is this: AI has become a U.S. strategic asset, forcing companies to prevent technology leaks. However, enhancing protection slows down development and even creates obstacles for the IPOs that OpenAI and Anthropic are planning. Departed researcher Depew, who left in April, insisted that speed should not be sacrificed for security. OpenAI spokesperson Widmann countered this, stating that the company is “one of the most frequently attacked organizations in the world” and has invested heavily in defenses; the company added that its most sensitive projects have been moved to independent repositories with strict access control, and that since appointing CISO Stacki in October 2024, regular tool security reviews have been conducted.