Tal Feldman is a Yale Law School student who previously built artificial intelligence models for the U.S. government. Ibrahim Dagher is pursuing law and PhD degrees at Yale and writes about AI policy and national security.
OpenAI recently learned that a Saudi employee allegedly planted an audio recording device in an executive meeting room. There, at the company’s San Francisco headquarters, senior staff frequently discuss confidential information, including proprietary research.
This incident adds to mounting evidence showing serious weaknesses in the security of America’s frontier artificial intelligence companies. For months, public discourse has focused on AI agents breaking into other companies, and rightfully so. But far less attention has gone to whether AI firms themselves can keep hackers out.
In July, three researchers broke into OpenAI. They were the good kind of hackers, hunting for bugs and reporting what they found to OpenAI, which paid them a $6,500 bounty. Along the way, they accessed an internal code repository containing the company’s algorithmic secrets. And they didn’t have any particularly sophisticated hacking tools. “We’re just three guys with Claude and Codex subscriptions,” one of them told the Wall Street Journal, referencing widely available Anthropic and OpenAI coding agents. Nor did they spend a long time on this: It took them less than 72 hours. (The Washington Post has a content partnership with OpenAI.)
This was not the first time. In 2023, a hacker broke into OpenAI’s internal messaging system and obtained information about the company’s research. OpenAI did not inform the FBI or the public.
These incidents should be a wake-up call because nations such as China — America’s chief competitor in the AI race — do have the sophisticated tools and time to penetrate AI firms in the United States. Most importantly, they have the motive: Stealing America’s best AI models would let them catch up for free. The work the U.S. has done, from restricting sales of its most advanced chips to investing billions in the AI build-out, would be for naught if cybersecurity in labs is not taken seriously.
Three break-ins should be more than enough. If you see three ants in your kitchen, the total number of ants in your kitchen isn’t three.
The AI companies are not hiding the ball on this issue. They have been unusually candid that they are not prepared to deal with high-level espionage.
In 2023, Anthropic chief executive Dario Amodei was discussing whether his company could fight off a government whose top priority was stealing a model’s weights — the trillions of numbers, produced by months of expensive training, that make up an AI model. “No. They would succeed,” he said. Anthropic was a smaller company then. But this August, Anthropic released a risk report saying it could not defend against nation-state actors and that it does “not believe any frontier AI developer currently meets this bar.” Jacob Coxon, a former Anthropic and OpenAI researcher, remarked that no U.S. lead can last because Beijing can “step in and steal our progress at any time.”
Miles Brundage, who worked on OpenAI’s readiness for advanced AI, wrote on X that AI companies “don’t even claim to be able to protect their model weights from tampering/theft by state actors today.”
Researchers at Rand have catalogued 38 ways to steal a model’s weights, including malicious placement of portable devices, tampering with hardware before it is installed and bribing or coercing an employee. Because labs often train and run many of their models out of data centers operated by cloud companies, those facilities are another way in.
And it’s not just the AI models themselves. The industry’s algorithmic secrets are also poorly protected. Amodei told the Council on Foreign Relations last year that some “$100 million secrets” in the AI industry consist of just a few lines of code. “I’m sure that there are folks trying to steal them,” he said, “and they may be succeeding.”
Meanwhile, the AI companies are locked in a fierce competition to reach superintelligence. Every dollar or minute of employee time spent strengthening cybersecurity is not spent on training the next AI model. Anthropic has argued that repelling well-resourced state actors should be a cybersecurity priority for the industry. But it “cannot commit to following” that on its own.
Fortunately, the U.S. government has levers it can pull to mandate security protocols at AI labs, even without a new statute. Start with the Pentagon. Congress last year ordered it to write security standards for the AI it buys, and to impose them on contractors and cloud providers involved. But 10 months later, it still has not begun the public process to amend its rules.
The Commerce Department can require a license to export a company’s models and grant one only to labs that meet certain security standards. This is how the Trump administration forced Anthropic to pull its Mythos and Fable models from the market in June. The government can also write security terms into the federal loans and land leases behind the data-center boom. This would mean that only AI companies that meet stringent security guidelines could take advantage of public land or federal financing.
The U.S. is locked in a fierce competition to beat China in the race to superintelligence. If three researchers with Claude subscriptions could get into OpenAI in three days, a foreign government with a massive budget and no deadline can certainly do it, too.
The post ‘Just three guys’: Break-ins at OpenAI are a warning to America appeared first on Washington Post.
