Editor's note: The quotation attributed to OpenAI's spokesperson and the framing of an "internal investigation" derive from the original source item (The Hacker News, citing The Wall Street Journal). Readers should verify against the rendered source pages before citing this article as primary evidence.
OpenAI says it "parted ways" with three members of its safety team after an internal investigation found that the individuals violated company policy on accessing and handling sensitive information.
A spokesperson for the company was quoted by The Wall Street Journal as saying: "we have parted ways with three individuals for violating our policies on accessing and handling sensitive company information," adding that the investigation confirmed the violations. The account was subsequently covered by The Hacker News.
The three individuals have not been named. OpenAI has not publicly disclosed what material was involved, whether any of it left the company, or whether customers, regulators, or any other external parties were notified.
Notably, the company's own statement describes policy violations — not an exfiltration, and not a leak of sensitive data to outside parties. That distinction is significant: the confirmed finding is narrow, while the broader question of what information was accessed, and where it went, remains unanswered.
A backdrop of contested departures
The exits sit against a well-documented pattern of turbulence at the AI lab. High-profile departures of senior safety figures and the dissolution of internal alignment research teams have, in earlier reporting, shaped an ongoing public debate about how frontier AI companies govern their own research — and it is against that backdrop that this episode is now being interpreted.
The current episode involves a far narrower allegation. Internal policy breaches are a different matter from a dispute over a lab's safety roadmap, and nothing in OpenAI's public statement connects the two. But departures around major model releases have drawn scrutiny before, and no connection between this case and those episodes has been established either.
What is still unknown
The unknowns are significant. The identities of the three individuals, the nature of the information involved, whether findings will be disclosed to customers or regulators, and whether the departures will affect any published safety work all remain open. OpenAI's statement confirms policy violations; it does not describe an external leak, and no external disclosure has been reported.
For enterprise readers, the narrowness of what is confirmed is itself instructive — it is precisely why vendors' internal governance, rather than press reporting, is where due diligence should be directed.
Analysis: why this matters for enterprise buyers
The following section is editorial analysis, not sourced reporting from the article's primary material.
For Hong Kong organisations evaluating frontier models for regulated workflows — in banking, insurance, healthcare, and the public sector — the incident is best understood as a governance question rather than an AI-safety question.
AI safety teams at frontier labs typically hold some of the most sensitive material inside the organisation: unpublished evaluation results, red-team findings, pre-release model weights and internal risk assessments. That makes their access patterns a matter of vendor diligence, not just HR policy.
Three practical questions follow for procurement and compliance teams:
1. Audited staff confidentiality controls. Does the vendor maintain access logs, least-privilege separation, and periodic attestation for staff with access to pre-release models and evaluation data — and can those controls be independently audited?
2. Contractual incident notification. Do service agreements specify timelines for notifying customers when incidents involving model integrity, data handling, or staff misconduct may affect deployed services or roadmaps? NDA obligations to customers, in other words, cannot outrun a lab's obligations to itself.
3. Independent governance submission. Can the vendor provide evidence of third-party or independent oversight over internal safety and security incidents — including documentation of findings, remediation, and whether any external parties were informed?
These are not hypothetical concerns. For additional background, Hong Kong's Privacy Commissioner for Personal Data (PCPD) has published an AI Model Framework setting out principles for accountability, transparency, and security when organisations deploy AI systems, including those supplied by third parties — although that framework is not part of the reporting on this OpenAI episode. Enterprises that collect or process personal data through vendor-hosted models carry their own compliance obligations, which makes understanding the supplier's internal controls a practical necessity.
The takeaway is narrower than the headlines suggest but no less consequential: at frontier AI vendors, insider risk and customer trust must be weighed with equal care — and that balance is precisely where due diligence belongs.
編者按：文中引述 OpenAI 發言人的言論，以及「內部調查」的定性，均源自原始來源條目（The Hacker News，引述《華爾街日報》）。讀者在引用本文作為第一手資料前，應先核對來源頁面的正式版本。
OpenAI 表示，在內部調查發現三名安全團隊成員違反公司有關存取及處理敏感資料的政策後，公司已與他們「分道揚鑣」。
《華爾街日報》引述公司發言人表示：「我們已與三名違反存取及處理公司敏感資料政策的人士終止合作」，並補充指調查已確認上述違規行為。其後 The Hacker News 亦報道了有關事件。
該三名人士的身份並未公開。OpenAI 亦未公開披露事件涉及何種資料、是否有資料流出公司，以及客戶、監管機構或其他外部單位是否已獲通知。
值得注意的是，公司自身的聲明所述的是政策違規——而非資料外洩（exfiltration），亦非敏感資料洩露予外部人士。這個區別相當重要：已確認的調查結果範圍狹窄，而究竟哪些資料被存取、資料流向何方等更廣泛的問題，則仍然懸而未決。
背景：備受爭議的人事變動
此次離職事件，發生於這間 AI 實驗室一連串人事動盪的背景之下。資深安全人員的備受注目離職，以及內部對齊（alignment）研究團隊的解散，在早前的報道中已塑造了一場至今持續的公開討論，焦點在於前沿（frontier）AI 公司如何管治自身的研究工作——而今次事件正是在此背景下被解讀。
不過，今次事件涉及的指控範圍遠為狹窄。內部政策違規與實驗室安全路線圖的爭議屬兩回事，OpenAI 的公開聲明中亦沒有任何內容將兩者相提並論。但重大模型發佈前後出現的人事變動曾引起外界質疑，至於今次事件與那些事件之間是否存在關聯，目前亦未有證據顯示。
仍然未知的資訊
未知之處相當關鍵。三名人士的身份、涉及資料的性質、調查結果會否向客戶或監管機構披露，以及離職事件會否影響任何已公布的 AI 安全研究，全部仍屬未知。OpenAI 的聲明確認了政策違規，但並沒有描述任何外洩事件，亦未有報導指進行了任何對外披露。
對企業讀者而言，已確認事項範圍之狹窄本身已具啟發性——這正好說明了 due diligence（盡職審查）應當著眼於供應商的內部管治，而非新聞報道。
分析：這對企業買家有何啟示
以下段落屬編者分析，並非源自本文主要來源的有據報道。
對於香港機構而言，若正在評估 frontier 模型以用於受規管的業務流程——例如銀行、保險、醫療保健及公共部門——事件與其說是 AI 安全問題，不如說是治理問題。
frontier 實驗室的 AI 安全團隊，通常掌管著機構內最敏感的資料：包括未公開的評估結果、紅隊測試（red-team）發現、發佈前的模型權重（model weights），以及內部風險評估。這意味著他們的資料存取模式，屬供應商盡職審查的範疇，而不單是人力資源政策問題。
採購及合規團隊因此需思考三個實務問題：
1. 可審計的員工保密控制。 供應商是否為可存取發佈前模型及評估資料的員工，維持存取記錄（access logs）、最小權限分隔（least-privilege separation）及定期聲明確認（periodic attestation）？而這些控制措施，能否接受獨立審計？
2. 合約上的事故通知機制。 服務協議有否訂明，當涉及模型完整性（model integrity）、資料處理或員工不當行為的事故可能影響已部署服務或產品路線圖時，通知客戶的時限？換言之，對客戶承擔的保密協議（NDA）義務，不能凌駕於實驗室對自身的管治責任之上。
3. 獨立治理提交。 供應商能否提供證據，證明對內部安全事故及資訊保安事故存在第三方或獨立監察？其中包括調查結果的文件紀錄、補救措施（remediation），以及是否有外部單位獲通知。
這些並非假想的憂慮。作為補充背景，香港個人資料私隱專員公署（PCPD）已公布《AI 模型框架》，訂明機構部署 AI 系統——包括由第三方提供的 AI 系統——時，在問責、透明度及保安方面應遵循的原則；惟該框架並非本篇 OpenAI 事件報道的內容。透過供應商託管（vendor-hosted）模型收集或處理個人資料的企業，本身負有合規責任，因此了解供應商的內部控制措施，實屬必要。
總結而言，今次事件的意義較標題所示更為狹窄，但後果同樣重要：對 frontier AI 供應商而言，內部風險（insider risk）與客戶信任如今必須同等審慎權衡——而這正是 due diligence 應當著眼的平衡點。