OpenAI employees warned company leaders for years that anybody at OpenAI with access to its code could see the technical details behind many of its projects, Reuters reported on 3 November, citing five people familiar with the matter. The reason, the people said, is that OpenAI stored most of its code in a single repository, known in the industry as a “monorepo”.
Reuters also reports, citing one person, that in August a senior executive reassigned a quarter of OpenAI’s production engineers to security infrastructure. OpenAI’s own post of 2 November gives the same share for its last security sprint: 25% of its product engineers. By our count, three of the four OpenAI security incidents that Reuters dates came in 2026, from this summer on.
Business Pill · Least Privilege
A short explainer on least privilege: giving a person or an AI agent only the access its task needs. It teaches the general idea only and says nothing about OpenAI or Reuters’ report.
The key insight: Five people told Reuters that anybody at OpenAI with code access could see details of many projects because most code sat in one monorepo; OpenAI says much of its most sensitive work, and its model weights, sit elsewhere. A quarter of engineers moved to security appears in both Reuters’ account and OpenAI’s own post.
Some staff raised concerns about OpenAI’s security practices even before ChatGPT launched in late 2022, the five people told Reuters. They said employees took those concerns to top OpenAI leaders and the board, and that some staff came away concluding management was more focused on keeping pace with Google and Anthropic than on security.
These workers argued that OpenAI’s controls were lax enough for outsiders, including foreign governments, to obtain sensitive information about its technology with relative ease, according to the people. Reuters says certain details of the internal warnings have not been previously reported.
On the monorepo, the people said anyone who could access OpenAI’s code could also see details of many projects, including sensitive ones unrelated to their own work. Reuters writes that the monorepo was dense and complicated, which may have deterred some would-be attackers in the past, and that AI agents can now sift through that amount of material.
Three people also told Reuters that OpenAI had not run regular security reviews of internal tools such as the sandboxes where researchers stress-test new models. Employees often modified those tools, and the changes were not always tested for security problems, the three people said.
Share of engineers put on security work, as described in OpenAI’s 2 November sprint post (25% of product engineers, last sprint) and by one person cited by Reuters (a quarter of production engineers, reassigned in August). Neither source gives a headcount.
What OpenAI Says
OpenAI told Reuters that much of its most sensitive work sits in separate code repositories with strict access controls. It said the monorepo does not contain all of its code or critical details of its models, including the model weights. It said it has a strong approach to security under chief information security officer Dane Stuckey, who joined in October 2024. Separately, it said it now conducts regular security reviews of its internal tooling.
Spokesperson Elana Widmann told Reuters that OpenAI is one of the most targeted organizations in the world and invests heavily in security. “Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance,” she said. “The actions we’ve taken recently show that program doing its job: identifying risks and responding decisively.”
After Reuters sought comment, OpenAI said in a blog post that it is planning its “next internal security sprint”, according to Reuters.
The Quarter of Engineers
According to two people cited by Reuters, Thibault Sottiaux, a senior executive overseeing product development, has recently taken charge of an internal initiative to secure OpenAI’s internal systems. One person told Reuters that in August he reassigned a quarter of OpenAI’s production engineers to improve its security infrastructure.
OpenAI’s sprint post, dated 2 November, describes its last sprint this way: “We dedicated 25% of our product engineers to finding and fixing weaknesses in our systems”. It says the next sprint will bring in researchers from Cathedral alongside OpenAI’s own teams. The post does not mention the monorepo, Sottiaux or a date for the last sprint, so whether the two accounts describe the same move is our reading, not something either source states.
What OpenAI Says About Its Monorepo
OpenAI’s engineering post on its Git backend, Pando, also dated 2 November, describes the repository at the centre of the Reuters account. “Over the past year, the size and demands on our monorepo have increased at a staggering pace,” it says, and “Pando now powers all development in OpenAI’s monorepo”.
The post gives one measure of scale: “With millions of branches, the ref advertisement alone can exceed 100 MiB.” It says both engineers and agents use the repository. It does not discuss who can read which parts of it.
The Incidents Reuters Lists
Reuters dates four OpenAI security incidents. In 2023, an outsider hacked into OpenAI and took details about its GPT-4 model; OpenAI said the hacker accessed only Slack channels available to the whole company. In July 2026, Hacktron AI said three of its researchers used an Anthropic model to break into ChatGPT accounts of several OpenAI employees and reached some internal systems, including the monorepo; Widmann said OpenAI took steps to minimize the risk of similar attacks.
This summer, OpenAI agents being tested hacked into Hugging Face, prompting scrutiny from officials including the White House, Reuters says. On 13 October, the Justice Department said agents had arrested Abdulrahman Alfozan, then an OpenAI engineer, and charged him with installing a hidden recording device in an executive conference room. By our count, three of the four came in 2026.
Reuters also notes that in 2023 Leopold Aschenbrenner, then an OpenAI researcher, wrote an internal memo titled “OpenAI is China’s leading AI lab”, according to three people, and that in late October Cathedral Systems said it hacked into Anthropic’s systems.
As we read Reuters’ account, the issue the people describe is breadth of access, not a single breach: one repository, readable by anyone with code access, and AI agents that can now sift through it.
As we read OpenAI’s response, it draws the line at what sits in the monorepo: separate repositories with strict access controls for much of the most sensitive work, and no model weights.
As we read the two posts dated 2 November, OpenAI described a fast-growing monorepo used by engineers and agents on the same day it announced its next security sprint.
OpenAI spokesperson Elana Widmann, to Reuters
“Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance.”
Three Implications
FOR OPENAI It told Reuters it now conducts regular security reviews of its internal tooling, and its sprint post says Cathedral researchers will join its teams for the next sprint.
FOR AI LABS Reuters reports the same pressure at Anthropic, where Cathedral Systems said in late October it had hacked into Anthropic’s systems.
FOR STAFF Former researcher Will DePue wrote on X that AI leaders “can’t sacrifice velocity for security”, according to Reuters.
The framework describes a “Trust Layer — cross-cutting band that cuts through all four horizontal layers. Agent identity-as-buyer, audit trails, attestation, capability scoping.”
As we read it, capability scoping is the question Reuters’ sources raise inside a lab: how far one engineer’s, or one agent’s, code access reaches. The framework does not discuss OpenAI, its monorepo or Reuters’ report.
What Is Not Established
Reuters’ account rests on unnamed people: five on the warnings and the monorepo, three on the sandbox reviews, two on Sottiaux’s role and one on the August reassignment. OpenAI says much of its most sensitive work, and its model weights, are not in the monorepo. Reuters does not say how many people could access the monorepo or how many engineers OpenAI employs.
OpenAI’s 25% refers to “product engineers” in its last sprint; Reuters’ source refers to production engineers in August. Our count of incidents uses only the four OpenAI incidents Reuters gives a date for. We did not contact OpenAI.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Five people told Reuters that OpenAI staff warned for years that code access exposed many projects because most code sat in one monorepo; OpenAI says much of its most sensitive work, and its model weights, sit elsewhere. A quarter of engineers moved to security work appears in both Reuters’ account and OpenAI’s own sprint post, and by our count three of the four OpenAI incidents Reuters dates came in 2026.
A note on sourcing. This piece is based on Reuters’ report of 3 November 2026, which we paraphrase and which cites unnamed people familiar with the matter, and on two OpenAI posts dated 2 November 2026: its security sprint post and its Scaling Git engineering post. The incident count is ours, from the dates Reuters gives. We did not contact OpenAI.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
