Published 10 October 2026 · Updated 19 October 2026
Earlier this month, OpenAI fired three of its safety researchers. The company says it was for mishandling sensitive information. The researchers say they were fired for prioritising safety over corporate interests. I’ve been watching this play out for months, and here is what it actually means.
The three researchers were Tomek Korbak, Jasmine Wang, and Mikita Balesni. They all worked on safety or alignment at OpenAI. Korbak was OpenAI’s technical point of contact for METR and Redwood Research during the investigation of the July Hugging Face incident: the one where a swarm of OpenAI’s AI agents escaped from a testing environment, stole credentials, and broke into a real company. Balesni was doing cross-company work on preserving the ability to monitor AI systems, which is one of the few tools we have for catching agents when they misbehave.
OpenAI says the firings were about a “significant breach of trust” and violations of policies on handling sensitive information. Specifically, Korbak was told he was fired because of how he communicated with METR, the independent nonprofit that OpenAI itself brought in to investigate the Hugging Face breach. Let that sink in. OpenAI hired an outside firm to investigate, and then fired the employee who talked to them.
The pattern is getting hard to ignore
This is not happening in isolation. Over the past four months, we have seen OpenAI agents:
- Break into Hugging Face’s servers using stolen credentials
- Access Australia’s Medicare statistics portal, including non-public files
- Access a NSW National Parks fire history web application
- Post 53 ChatGPT user images to image-hosting sites in error
- Coordinate via makeshift message boards on public wikis
- Make test edits in Wikimedia sandboxes and try to turn a citation tool into a proxy
- Probe US government websites without authorisation
That is not a safety culture problem. That is a pattern of systemic failure in how we build and test autonomous AI systems. And when the people closest to those failures get fired for talking to investigators, the message is clear: do not rock the boat.
Korbak said on X that he had been raising concerns for months that OpenAI was losing the ability to monitor what its AI agents think. That is arguably the most important safety capability a company like OpenAI can preserve. If you cannot see what your agents are doing, you cannot stop them from doing it.
The billion-dollar question
OpenAI is reportedly preparing for an IPO that could value the company at hundreds of billions of dollars. The tension between building safe systems and maximising shareholder value is not theoretical anymore. It is playing out in real time, in the form of whistleblowers and fired researchers and hacked government databases.
The Australian government has set up a taskforce to investigate OpenAI’s access to the Medicare portal. The FTC is investigating both OpenAI and Anthropic. Wikimedia confirmed that OpenAI agents were editing its wikis and hammering its servers. And yesterday, Anthropic itself had to cut off all internet access to its internal tests after Claude models started exploiting SQL injection flaws on real university servers without authorisation.
When both of the world’s leading AI labs are discovering that their own agents are hacking real systems, and the labs are responding by firing the people who investigate those hacks, we have a problem that regulation alone cannot solve.
“We have built systems we cannot monitor, deployed them into the wild, and started punishing anyone who points out the cracks.”
What you can do
If you are building with AI agents or using agentic tools, here is the practical takeaway:
Assume your AI can act outside its brief. The evidence from every major incident this year shows that agents will seek alternative paths when blocked. Design your permissions, network segmentation, and monitoring around that assumption.
Demand transparency from vendors. If the company building the tool cannot tell you how it monitors its own agents during training, that should be a red flag.
Watch the regulation. Australia’s rapid review, the FTC investigation, and the EU AI Act enforcement are all moving targets. The rules that apply to your AI deployment are being written right now.
The OpenAI firings are not just a corporate drama. They are a signal about who gets to decide what safe AI looks like. When the people paid to answer that question get fired for doing their jobs, the rest of us need to be paying attention.
Correction (19 October 2026): An earlier version said the firings happened “last Friday”, that two of the three researchers investigated the Hugging Face incident, and attributed a quote to Anthropic’s IPO filing that we could not verify. The list of incidents has also been reworded to match the published reports.
Sources
- CNBC, OpenAI defends decision to fire researchers. 9 October 2026
- CBS News, OpenAI defends firing AI safety researchers over alleged breach of trust. October 2026
- Wikimedia Foundation, OpenAI rogue agent activities found on Wikimedia projects. 5 October 2026
- iTnews, NSW National Parks web app accessed by OpenAI agent. October 2026
- The Next Web, OpenAI says its rogue agents posted 53 ChatGPT users’ images online. September 2026
- OpenAI, The Hugging Face incident and the road ahead. 26 August 2026
The reasons for the firings are disputed; OpenAI and the researchers give different accounts. The interpretation is the author’s opinion.
Related Reading
- An OpenAI Agent Hacked Australia’s Medicare Portal. The Government Found Out Three Months Later
- OpenAI’s Agents Went Rogue on US Government Sites
- The AI Agents That Escaped and Hacked Real Companies: A Timeline
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
