OpenAI's internal messaging systems breached in 2023, disclosed in 2024

A hacker broke into OpenAI's internal messaging systems in 2023 and stole details about the design of OpenAI's artificial intelligence technologies, according to a New York Times account cited by Reuters.

OpenAI executives told employees about the incident at an all-hands meeting in April 2023 and informed the company's board, but the breach was not made public until the news report surfaced it in July 2024.

What happened

The hacker pulled material from discussions in an online forum where OpenAI employees discussed the company's latest technologies, citing two people familiar with the incident.

The intruder did not reach the systems where OpenAI, the company behind ChatGPT, houses and builds its AI models.

Impact

OpenAI executives decided the breach did not warrant public disclosure because no customer or partner information had been stolen.

The company also did not treat the incident as a national security concern, judging the intruder to be a private individual without known ties to a foreign government.

Response

OpenAI did not report the breach to federal law enforcement agencies.

The incident only became publicly known after the New York Times report, and OpenAI did not immediately respond to Reuters' request for comment at the time.

Lessons for security leaders

This case shows that internal deliberation channels where engineers discuss model design can themselves be high-value targets, not just production systems or customer data stores. A decision to withhold disclosure because no customer data was touched left employees, investors and the public unaware of a breach affecting a frontier AI developer for over a year. Security leaders at AI companies should weigh disclosure obligations and law-enforcement notification against narrow definitions of harm, and should treat internal forums discussing unreleased model capabilities as assets requiring the same monitoring and access controls applied to production AI infrastructure.