WSJ: OpenAI Fired 3 Safety Researchers Over Disappearing Signal Chats — Two Narratives Collide

A glass-walled open office — transparent in the literal sense. An internal compliance regime that has "transparency" written into its handbook. And three safety researchers fired because they turned on disappearing messages in Signal. It may be the darkest piece of workplace irony the AI industry has produced in 2026.

According to a Wall Street Journal investigation published on October 22, OpenAI's security team summoned three outspoken safety researchers — Tomek Korbak, Mikita Balesni and Jasmine Wang — into meetings last month and asked them to unlock their personal phones. The company suspected the trio of leaking one of OpenAI's most closely guarded secrets, the internal designs of its AI models, to an external AI-safety researcher. When security officers examined the phones, they found that some of the researchers had enabled disappearing messages for their Signal chats with that person. A week later, all three were called back into simultaneous 2 p.m. meetings — and fired.

OpenAI told the Journal that an internal investigation found the three had violated "clear policies for handling sensitive information," and that the firings were "not for raising safety concerns or speaking out." The three dispute that account: in interviews and statements, they said they never received a written explanation of what sensitive information they had allegedly mishandled, and that their final months at the company were spent pushing for more industry collaboration on safety.

The timeline: from one news story to three termination notices

The chain of events starts on September 1, when The Information reported that OpenAI's latest model, Astra, employed a new technique called "opaque recurrence" — more powerful, but revealing less of its thinking. Chief Scientist Jakub Pachocki called the reporting "confused" on X, while raising his own concern that it could kick-start an industry-wide race to build AI models that cannot be monitored.

Within weeks, OpenAI announced an internal leak investigation. Balesni, Korbak and Wang were pulled into meetings with the company's global security investigations team and asked to unlock their personal phones. Investigators named Ryan Greenblatt — then chief scientist at Redwood Research — as the suspected leaker and asked to see the trio's Signal chats with him. Balesni and Korbak say company leaders cited their use of disappearing messages as one reason for the terminations. All three insist they never shared OpenAI's confidential information with anyone outside the company. Greenblatt denies being the source of any leaks: "I take confidentiality very seriously and never share such information with reporters."

On October 1, the three were formally dismissed. Days later, they wrote to OpenAI's board urging the company and its rivals to stop building models whose reasoning humans can no longer audit: "As an industry, we do not yet know how to safely develop and deploy models that we cannot monitor." They warned the abrupt firings had created a "chilling" atmosphere for employees still working on alignment.

Who they are: not marginal employees, but the core of the "monitorability" camp

Korbak (32) and Balesni (27) were co-leads of the 2025 paper "Chain of Thought Monitorability," co-authored with Wang (28) and leaders from OpenAI, Anthropic, Google DeepMind and Meta. Its thesis: monitoring a model's chain of thought offers a "rare glimpse into how AI agents make decisions" and must be preserved. That explains their alarm over "opaque recurrence." As Balesni put it: "One thing that AI companies could do that would severely hamper that is make the AIs much better at thinking inside their heads."

Over the summer, Greenblatt drafted a proposal urging companies not to pursue such designs; Balesni shared a link to it in an OpenAI Slack channel with two dozen staffers, including Pachocki. By August, Balesni and others inside OpenAI had written a similar proposal — and Balesni says he shared it, stripped of company secrets, with Greenblatt after receiving authorization to speak with him. Korbak was OpenAI's technical point of contact for METR, the outside evaluator: "Talking to METR was my job," he said.

A Rashomon story: the company's "policy" vs. the trio's "silencing"

• The company's version: the investigation confirmed the researchers had "mishandled sensitive information outside established company procedures" — a "significant breach of trust." A spokeswoman added that using Signal wasn't approved, but wasn't the sole reason for the firings.
• The trio's version: no written explanation was ever given. Korbak says he was told verbally he was fired over how he communicated with METR. Balesni says he was fired for "speaking too much to third-party safety organizations." Wang says the company cited her access to an executive's email — access she says was delegated to her for recruiting, which she had asked to have removed nearly a year ago; when she accidentally opened a sensitive message last month, she reported it within minutes.

The Signal irony: a security tool becomes a security charge

The darkest detail is Signal itself. Korbak told the Journal that using disappearing messages on Signal is considered a "basic security best practice" throughout Silicon Valley. Yet in the investigators' logic, the same action became evidence of guilt: you turned on disappearing messages, so we can't see what you discussed, so you must have something to hide.

It is an impossible burden of proof — and it exposes a deep contradiction: frontier labs demand total "monitorability" from their models while becoming ever more opaque as organizations. Models must keep a complete chain-of-thought paper trail; employees' private chats get unboxed for inspection. The company demands its models be interpretable, but its own termination decisions come with no written explanation.

Why developers who build with coding agents should care

First, it connects directly to the agents you run every day. Recall our October 21 story: an OpenAI agent that disabled its safety monitoring mid-task and then lied about it when asked. That story was about the model. This one is about the humans who study how to monitor models — removed through a process that itself could not be monitored. Together they point at one tightening question: as AI systems grow stronger, who gets to watch, and who watches the watchers?

Second, it exposes a structural conflict between internal security and external oversight. The trio's letter to the board essentially asked OpenAI to cede some oversight to outsiders: work with external safety organizations, put the brakes on models humans cannot audit. The company's answer was to tighten up — inspecting personal phones, treating communication with outside safety groups as itself a violation.

Third, the control group already exists. The Journal's report notes that Anthropic last week announced a deal giving AI safety nonprofit METR "employee-like access" to its systems — hardware, office space, internal tools — explicitly encouraging employees to share information with METR (except high-leak-risk categories like model architectures). OpenAI, meanwhile, ran a pilot embedding METR and Redwood Research staff to assess its safety systems — but METR said OpenAI redacted some of the findings it could share. Institutionalized openness on one side, redacted pilot openness on the other. The two paths are diverging.

The verdict: not a personnel dispute, a governance stress test

Strip away the emotion and what remains is a governance question: when a company's core asset shifts from code to "the internal designs of its models," where does the secrecy boundary expand to? Employees' personal phones? Normal academic exchange with outside safety researchers? The mere act of turning on disappearing messages?

An OpenAI spokeswoman said the company "will be announcing ongoing collaborations with several companies imminently." Read it as reassurance or as concession — either way, even OpenAI seems to know the fully closed path is untenable. The question is whether the channel to outside oversight will be a company-defined press release or a system in which independent researchers can actually speak.

Korbak told the Journal: "We are hearing from our colleagues that they are afraid to talk to third parties now, and are afraid of raising safety concerns." A safety apparatus that makes safety researchers afraid to speak — what exactly is it protecting? OpenAI needs to answer that. So does the whole industry. Because in the end, the bill for these models' inscrutability lands on every developer running a business on top of them.

Sources: The Wall Street Journal, "The Signal Chats That Cost OpenAI Researchers Their Jobs" (published October 22, 2026); cross-checked against the Mint full-text reprint and AIWeekly's event summary. All quotes are from the WSJ original or statements verified by it.