OpenAI’s security team called three outspoken safety researchers into meetings last month and asked them to unlock their personal phones. The company suspected the three of leaking information to an external AI-safety researcher about one of OpenAI’s most closely guarded secrets: the internal designs of its artificial-intelligence models. When security officers examined the phones, they saw some of the researchers had turned on disappearing messages for their chats with the person on the app Signal. A week later, the three were summoned again to simultaneous 2 p.m. meetings—and fired.“I was told that there was a breach of trust because I interacted with a third party through unsanctioned channels,” said Tomek Korbak, one of the fired researchers.

The firings came in the throes of a battle over how to keep AI systems under human control—and who gets to see the secret designs that could determine the winners of the biggest commercial race in history. Tech leaders are pushing for model breakthroughs, but a string of unauthorized actions taken by clusters of AI agents—stretching back to July’s hack on Hugging Face—has revealed challenges the companies face in understanding and controlling their creations.

That has ignited a societal debate over how best to monitor and regulate the new technology. OpenAI told The Wall Street Journal that it fired the three researchers after an internal investigation found they violated “clear policies for handling sensitive information,” and “not for raising safety concerns or speaking out.”The researchers—Korbak, Mikita Balesni and Jasmine Wang—dispute that account.

In an interview and a statement, the three said they never received a written explanation for what sensitive information they allegedly mishandled, and spent their final months at the company pushing for more industry collaboration on safety. In particular, the fired researchers said they had raised concerns inside OpenAI about potential new AI designs, or “architectures,” that could accelerate capabilities, but make the systems even harder to understand or control. They said they were worried their firing will serve as an excuse for OpenAI to close a channel to independent third-party oversight.

An OpenAI spokeswoman said the company already works with third-party safety organizations and “will be announcing ongoing collaborations with several companies imminently.”OpenAI research leaders have said they agree with the fired workers that “preserving the monitorability of frontier models requires an industrywide commitment, including from OpenAI.”

Other AI labs are also wrestling with how much to share with outside safety researchers. Anthropic last week announced a deal to give staffers from AI safety nonprofit METR “employee-like access” to the company’s systems including hardware, office space, internal tools and systems. The company said employees should share information with METR, except for categories including “model architectures,” which it said have a high risk of leaking.

On Thursday, OpenAI said it ran a pilot embedding researchers from METR and Redwood Research, another nonprofit, to assess its safety systems. METR said OpenAI redacted some of the findings it could share.

In August, WSJ broke down how AI models from OpenAI and other companies went rogue on the internet to steal information. Photo: Jason Redmond/Agence France-Presse/Getty Images‘Happy coincidence’OpenAI rolled out a new type of AI in late 2024 called a reasoning model.

It performed better at math and coding because it took time to work through problems, writing out its reasoning process on an internal scratchpad called a “chain-of-thought.”It represented a shift from the models powering early versions of ChatGPT, which produced answers almost instantly. Widely adopted in the industry, the feature offered clues about how modern AI models work.“We all felt like this is a happy coincidence that we want to hang onto,” said Joshua Saxe, a former AI security tech lead at Meta Platforms.

In 2025, before they joined OpenAI, Balesni, 27 years old, and Korbak, 32, were co-leads on a paper saying that monitoring a model’s chain-of-thought offered a “rare glimpse into how AI agents make decisions” that should be preserved. Other co-authors on the paper included Wang, 28, as well as leaders from OpenAI, Anthropic, Google DeepMind, and Meta.“One thing that AI companies could do that would severely hamper that is make the AIs much better at thinking inside their heads,” Balesni said.

This summer, some AI-company workers discussed efforts to develop new, more opaque models that could reason longer, without writing down as many interim steps.

Ryan Greenblatt, then chief scientist at Redwood Research, drafted a proposal for companies to avoid such a change. Balesni sent a link to the proposal in an OpenAI Slack channel that included two dozen staffers, including Chief Scientist Jakub Pachocki.

By August, Balesni and others at OpenAI wrote a proposal similar to Greenblatt’s, arguing that companies should agree not to pursue AI designs that prevent humans from seeing a model’s internal scratchpad.

Balesni said he shared it with colleagues and discussed it with a board member and a senior executive at the company. Balesni said he also shared the proposal, stripped of company secrets, with Greenblatt after receiving authorization from OpenAI to speak with him about it. Losing visibilityWhile Balesni fought to ensure that future AI models would continue to keep a scratchpad of their work, OpenAI researchers used those scratchpads to investigate an incident in which hundreds of its agents worked together to hack Hugging Face. OpenAI leaders also agreed to work with METR, the outside safety group, to investigate the Hugging Face incident.

The scope of METR’s work was at times a point of friction internally, according to people familiar with the matter. Mia Glaese, vice president of research and safety, wanted to ensure that third party groups wouldn’t be able to view OpenAI’s intellectual property, OpenAI said. Korbak said he raised concerns internally that METR wouldn’t get enough access.

OpenAI ultimately allowed METR to conduct a limited inquiry and named Korbak to the collaboration team. METR contracted Greenblatt, who had publicly urged an investigation, to help parse the logs.

Korbak said he communicated with Greenblatt through OpenAI’s internal Slack, as well as on Signal.METR’s report on how OpenAI’s agents had gone rogue laid the groundwork for the first great national panic over AI safety.

Jacob Coxon, then an Anthropic researcher, called it “a bit of a ‘holy s—’ moment” for him. Days later, Coxon resigned publicly with a viral warning that some AI researchers believed their products had a meaningful chance of wiping out humanity. Over the summer, Wang and other staff at major AI developers had also signed a letter calling for an international effort to slow down AI development so that safety research could keep up.

After Coxon’s resignation, the concept of “pacing” cutting-edge AI research was endorsed by AI leaders including Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman.“My overriding concern is that AI development is moving too fast,” Wang said in a statement.

On Sept. 1, tech news site The Information published a story that claimed OpenAI’s latest model, Astra, employed a new technique that made it more powerful, but revealed less of its thinking. OpenAI’s Pachocki called the reporting “confused” in a post on X, but raised his own concerns about kick-starting an industrywide race into developing AI models that can’t be monitored.

Within weeks, an OpenAI official announced internally that the company was launching an investigation into the leak. That is when Balesni, Korbak, and Wang, among others, were pulled into meetings with the company’s global security investigations team.

Balesni said OpenAI’s investigators named Greenblatt as the suspected leaker, and asked to see their Signal chats with him. Balesni and Korbak say OpenAI leaders cited their use of disappearing messages as a reason for their terminations. All three researchers claim they have never shared OpenAI’s confidential information with anyone outside the company.

The OpenAI spokeswoman said using Signal wasn’t approved, but its use wasn’t the sole reason for the firings. Korbak said using disappearing messages on Signal is considered a “basic security best practice” throughout Silicon Valley.

Greenblatt denies he was the source of any leaks of confidential information to The Information. “I take confidentiality very seriously and never share such information with reporters,” he told the Journal. Both Redwood and METR, which has since hired Greenblatt, said they take confidentiality seriously.

Wang was told she was fired for repeatedly accessing an executive’s email, she said in a statement.

Wang said she asked the company to remove her access nearly a year ago, but they didn’t, and she mistakenly opened a sensitive email last month that was addressed to this executive. She says she didn’t share its contents with others and immediately reported the incident. The OpenAI spokeswoman said the company didn’t have a problem with the access itself.“We are hearing from our colleagues that they are afraid to talk to third parties now, and are afraid of raising safety concerns,” said Korbak, who wants companies to develop clear rules for how staff can interact with auditors.

Balesni, Korbak, and Wang, in an October letter to OpenAI’s board, urged the company to work with external safety organizations to help stave off the “risk that something truly catastrophic will happen.”

Write to Maxwell Zeff at maxwell.zeff@wsj.com, Keach Hagey at Keach.

Hagey@wsj.com and Berber Jin at berber.jin@wsj.com