OpenAI Dismisses Employees for Mishandling Sensitive Information

OpenAI has dismissed several employees following an investigation into the mishandling of sensitive information. The BBC reports that the former employees were found to have shared internal data with an outside AI evaluation group without authorisation. The incident involved proprietary information related to OpenAI's models and internal processes. OpenAI confirmed the dismissals but did not disclose the number of employees involved or the full scope of the data shared. The case highlights ongoing concerns about insider risk within AI companies, where access to highly valuable intellectual property, model weights, training data and internal research creates significant security and commercial exposure. Insider risk is not unique to AI companies, but the nature of the data involved, the competitive landscape and the potential for misuse make these incidents particularly consequential.

Why this matters for UK organisations

For UK organisations working with AI vendors, deploying AI tooling or developing their own models, this serves as a reminder that third-party AI providers face the same insider threats as any other technology supplier. It also underscores the importance of understanding how vendors manage access to sensitive systems, enforce data handling policies and monitor for unauthorised activity. Organisations should consider whether their own internal controls around AI tooling, model access and data sharing are clearly defined and consistently enforced. The risks extend beyond intellectual property theft to include reputational damage, regulatory exposure and loss of competitive advantage. Insider risk is often difficult to detect because it involves authorised users with legitimate access to systems and data. The challenge is distinguishing between normal business activity and unauthorised data sharing or exfiltration. This requires a combination of technical controls, such as data loss prevention and access logging, and organisational controls, such as clear policies, training and a culture that encourages reporting of suspicious behaviour.

What to review

UK businesses should review how access to sensitive AI systems, proprietary data and third-party AI platforms is controlled and monitored. Consider whether insider risk controls, including access logging, data loss prevention, user behaviour analytics and clear acceptable use policies, are in place for employees working with AI tools or handling commercially sensitive information. Review whether access to AI model weights, training data, API keys and internal research is restricted to those who genuinely need it, and whether access is regularly reviewed and revoked when no longer required. Assess whether your organisation has visibility into data sharing activities, including file transfers, email attachments and cloud storage uploads, and whether anomalous behaviour would be detected and investigated. For organisations working with third-party AI vendors, consider whether vendor security assessments include questions about insider risk controls, access management and data handling policies. Finally, review whether your organisation has a clear process for investigating and responding to suspected insider threats, and whether employees understand their responsibilities around data handling and confidentiality.

Source: BBC Technology