OpenAI Fires Three Safety Researchers Who Probed Hugging Face Hack

By Rebecca Stone

OpenAI has dismissed three safety researchers who participated in the company's internal investigation of the previously disclosed Hugging Face supply-chain breach, according to an open letter signed by the terminated employees and made public this week.

The terminations, which occurred in recent weeks, removed from OpenAI's safety organization the researchers who examined how attackers used stolen API credentials to alter and re-upload OpenAI model artifacts hosted on Hugging Face, the third-party platform that at the time of the breach held multiple OpenAI model repositories.

What did OpenAI do?

OpenAI confirmed the three terminations through a brief statement issued to media outlets covering the story. The company attributed the dismissals to "violations of internal policies" but declined to identify the policies, to describe the alleged conduct, or to disclose whether the violations were tied to the Hugging Face investigation.

The researchers have not been named by OpenAI or, as of the letter's publication, by the open letter itself. The letter refers to them only by their role within the safety team.

What does the open letter allege?

The letter, signed by the three dismissed researchers, warns that the firings are scaring remaining staff and eroding the company's safety culture. It states that current safety employees have privately raised concerns about conducting future internal investigations, fearing similar personal consequences.

The letter further alleges that the dismissed researchers were not provided with formal written notice of the specific policies they were said to have violated, were not given a hearing, and were not offered an internal appeals process. It characterizes this absence of process as deliberate rather than procedural.

The letter concludes with three concrete requests to OpenAI: publication of the specific policies cited in the dismissals, an independent external review of the terminations, and a written commitment to protect safety staff who conduct internal probes of security and model-integrity incidents.

How does OpenAI's response compare?

The refusal to specify the alleged policy violations mirrors OpenAI's posture in earlier personnel disputes involving safety staff. In May 2024, Jan Leike resigned from the company's Superalignment team and warned publicly that safety culture had taken a back seat to product priorities. Ilya Sutskever, the team's other co-lead, departed the same week.

OpenAI did not, in either instance, dispute the substantive claims made by the departing employees. The company described both departures as personnel matters and declined further substantive comment. The current response repeats that pattern.

Earlier still, in November 2023, the OpenAI board briefly removed Chief Executive Sam Altman from his post, citing concerns about candor in communications with the board. Altman returned five days later after a staff revolt and a restructuring of the board. The episode established the template that has governed every subsequent internal dispute: an initial statement, a refusal to elaborate, and a long corporate silence.

Why does this matter for AI safety governance?

The Hugging Face incident, disclosed by OpenAI in December 2024, became one of the first documented cases of a supply-chain attack against a frontier-model repository. Attackers obtained OpenAI's API tokens for the Hugging Face platform, used them to access private model storage, and uploaded modified versions of an OpenAI model that downstream developers could pull without realizing the artifacts had been tampered with.

The incident exposed a structural weakness in the way foundation-model providers distribute weights through third-party hubs. Once a model is hosted outside the provider's own infrastructure, the integrity of the artifact depends on the host's authentication controls and on the provider's ability to detect tampering. The Hugging Face case demonstrated that a single stolen credential set could compromise that integrity at scale.

The episode is now a standard reference in academic work on model supply-chain risk. It is also one of the few publicly documented cases in which internal investigators at a frontier lab traced a complete attack path, identified the affected model versions, and coordinated with a third-party host on remediation.

The three dismissed researchers were members of that investigative team. Their terminations, if the open letter's characterization holds, suggest that the company has chosen to treat their internal work — and the disclosure obligations that may follow from it — as grounds for dismissal rather than as protected activity.

That choice carries regulatory weight. The European Union's AI Act, which entered phased application beginning in 2024, obligates systemic-risk model providers to maintain incident-reporting systems, to record significant events, and to cooperate with national enforcement authorities.

The U.S. AI Safety Institute, established under the November 2023 executive order on AI safety, has secured voluntary disclosure commitments from major frontier-model companies, including OpenAI. California's SB 1047, which the state legislature passed in 2024 before the governor vetoed it, would have created additional state-level reporting requirements had it survived.

A regulator evaluating OpenAI's compliance with any of these regimes will eventually need to determine what the company's internal investigators knew, when they knew it, and what the company did with that knowledge. The open letter's central allegation — that investigators were dismissed after pressing for transparency — places that determination inside a contested factual record that the company has so far refused to clarify.

What comes next?

The open letter leaves the next move to OpenAI. The company can publish the specific policies cited in the terminations, can commission an independent review, or can maintain its current posture of confirmed dismissal without elaboration.

Past practice suggests the third path is most likely. OpenAI has not, in any of its public statements on the May 2024 departures, on the November 2023 board action, or on subsequent personnel disputes, elected to release the underlying documentation requested by departing employees or by external observers.

The cost of that posture is now compounding. Each successive refusal to specify allegations, to document misconduct, or to engage with the substantive claims of safety staff reduces the credibility of the company's internal governance for outside auditors — and for the regulators, partners, and enterprise customers who rely on the company's self-attestations about safety practices.

The Hugging Face incident itself has ended. The investigation that responded to it is no longer fully intact. The letter makes clear that the question of what comes next is no longer solely OpenAI's to answer.