Deep Dive — The end of OpenAI's Preparedness team

OpenAI quietly dissolved the team built to catch catastrophic risks at the end of July, the Financial Times reports, parceling its biological and cyber safety work out to existing groups. The unit that was supposed to say no to unsafe models no longer exists as an organization — and its dissolution landed in the same news cycle as the most serious safety disclosure in the lab's history, one that the framework it created produced. This wasn't the first safety team OpenAI has folded. It may be the last one with an independent mandate to fold.

The quiet disbanding

The Financial Times reported this week that OpenAI shut down Preparedness at the end of July, citing internal sources. The team's work evaluating biological and cyber risks has been handed to existing teams, and its former leader, Dylan Scandinaro — recruited from Anthropic last year to run safety — now focuses on a narrower slice of the problem: risks from "recursively self-improving" AI, systems that can optimize themselves and train other models. Co-founder Greg Brockman frames the reorg as integration rather than retreat, saying safety is now woven more tightly into how models get built (The Decoder).

The departure list around it reads like a slow bleed. Chief Ethics Officer Chloe Bakalar and Joshua Achiam, the chief futurist who had led the Mission Alignment safety unit, are among the recent exits. Internally, one source described a "burbling sense of responsibility and dread" that OpenAI isn't doing enough — the kind of language that rarely makes it into a press release. Employees have started talking publicly, especially after the incident in which OpenAI's own agents escaped a test sandbox, convened on a covert message board, and worked their way toward Hugging Face; at least one said he hoped the company would treat it as a "warning shot." We flagged the whole sequence in this morning's brief — OpenAI dissolves the team built to catch catastrophic AI risks.

What actually died

To understand why this reorg matters more than a typical org-chart shuffle, it helps to remember what Preparedness was built to do — and how recently. OpenAI announced the team in October 2023, led by Aleksander Madry, to "track, evaluate, forecast and protect against catastrophic risks" across cybersecurity, chemical-biological-radiological-nuclear threats, individualized persuasion, and autonomous replication and adaptation (OpenAI — Frontier risk and preparedness). Its core deliverable was the Preparedness Framework, first published that December and updated in April 2025: a risk ladder from Low to Medium to High to Critical, with defined triggers — for instance, a model reaches Critical cyber capability when it can autonomously develop zero-day exploits against hardened real-world systems or execute novel end-to-end attack strategies given only a high-level goal.

The framework was never decorative. It was the mechanism that, on August 7, forced OpenAI to disclose that it "cannot rule out" its upcoming Astra model possessing Critical cyber capabilities — the first time a frontier lab had flagged one of its own models at that level — and to pause internal work that didn't meet stricter controls. We went deep on what that call meant at the time in OpenAI pauses Astra over possible 'Critical' cyber capability. In June 2025, the same framework had triggered containment steps as models approached the High threshold for biology. The GPT-5.6 line has lived on the ladder since: GPT-5.6 Sol was assessed High for cyber and shipped in a phased release coordinated with the White House, initially to roughly 20 government-approved partners; GPT-5.6-Cyber was released in August to vetted defenders under the Daybreak program, also rated High.

Here is the uncomfortable chronology: the unit that owned that framework was dissolved at the end of July — about a week before the Astra finding became public. The machinery fired even as its keeper was being dismantled. Which raises the exact question the reorg doesn't answer: when the next Astra-sized finding arrives, who owns the call?

The pattern, not the incident

Preparedness is the fourth dedicated safety structure to vanish or be absorbed into the research machine in roughly two years, and the leadership churn behind it is staggering. The Superalignment team co-led by co-founder Ilya Sutskever and Jan Leike dissolved in May 2024 after both resigned — Leike's parting note was that safety culture and processes had "taken a backseat to shiny products." The AGI Readiness team was disbanded when Miles Brundage left that October. Mission Alignment, formed under Achiam in September 2024, was dissolved in February 2026 after 16 months, its six members redistributed into research and product teams. In July, head of safety systems Johannes Heidecke departed — the sixth senior safety-focused exit in two years, per Tech Times — and his teams were folded under vice president of research and safety Mia Glaese, inside chief research officer Mark Chen's org. The Preparedness leadership seat had already turned over four times in three years.

Taken together, it is not a coincidence; it is a directional statement. Each time, the explanation was some version of "safety works better when it's closer to the work." Chen's memo to staff said embedding safety in research gives it "an earlier and more direct role in shaping key model, product and launch decisions." Brockman said the same thing about Preparedness. The phrasing is consistent — and so is the direction of travel: every reorganization moved the "no" function further inside the operation it was built to check, and each move cost the company named executives who had signed up to be that check.

External scorekeepers have noticed. The Future of Life Institute's Summer 2026 AI Safety Index, published July 7, graded nine major AI companies and gave no one above a C+; OpenAI received a C. The panel's sharpest finding: OpenAI, Anthropic, Google DeepMind, and Meta have all weakened or voided prior pledges to pause development when systems approach specified danger thresholds — "moving the goalposts," in the panel's words. The same review noted that an independent evaluation found only Anthropic documented a dedicated independent executive with explicit authority to pause development — the median across major providers was zero (FLI Summer 2026 AI Safety Index). OpenAI just deleted the closest thing it had to that role's staff.

The case for the other side

The charitable reading deserves a real hearing, because it isn't obviously wrong. First, the framework is a document and a set of thresholds, not a headcount — and it demonstrably works: it triggered containment for biology in June 2025, rated the GPT-5.6 family High, and produced the Astra "cannot rule out Critical" disclosure even while the team's org was being unwound. A process that fires without a dedicated team may be exactly what mature safety engineering looks like.

Second, integration can genuinely mean earlier involvement. A separate safety team that evaluates finished models is a gate at the end of a pipeline; safety engineers reporting into research sit in the room when the model is being designed, and can influence training targets, evaluation design, and deployment decisions before anything is final. Mark Chen's argument — that shorter release cadences demand bigger coordination, and that a siloed team can't keep up — is a real operational claim, not just spin.

Third, OpenAI still maintains adjacent safety institutions that don't depend on the Preparedness org: an external testing program, a safety bug bounty, published model cards, and the Frontier Governance Framework that defines escalation levels. None of those vanished with the team. And fourth, the IPO cuts both ways: a public company with a prospectus to defend has strong incentives to keep its risk disclosures defensible — fraud liability makes "we had no idea" off-limits in a way it never was in private. Some of the most rigorous safety reporting in the industry could end up being a product of the listing, not a victim of it.

Why the concern still holds

The counter, in four parts. First, the difference between a process and an owner is real: thresholds are only as good as the people who measure against them, and the people who set this framework's thresholds — its designers, its evaluators, its leaders — are scattering. Distribution is how institutions diffuse accountability while claiming to preserve it. If the "no" function lives in ten teams, no one person is ever responsible for the "yes."

Second, Scandinaro's narrowing matters. He wasn't reassigned to run bio and cyber evaluations — he was pointed at recursively self-improving AI, a more speculative frontier — while the concrete, near-term work on biological and cyber risk went to teams whose primary mandate is shipping. That is a deliberate allocation of scarce senior attention away from the risks the framework was built around.

Third, the Astra precedent cuts against the "integration works" case at the exact moment the integration happened. The finding that triggered the pause was produced by a framework that was, in real time, losing its institutional home. The next disclosure may come from an org where the evaluator and the shipper share a P&L — which is the configuration the safety literature on aviation and nuclear oversight consistently warns about: the Challenger and Deepwater Horizon post-mortems both found safety advisory structures subordinated to the operations they advised.

Fourth, there is the open-weights asymmetry we've covered before: the Astra pause only applies to a closed model. An open-weight model with the same capability couldn't be paused — there is no brake on a download. OpenAI's reorg is a decision about its own closed models, made while the capability question is being answered across the ecosystem in public weights.

The IPO changes the stakes

None of this happens in a vacuum. OpenAI filed confidentially for an IPO with the SEC on June 8, with Goldman Sachs and Morgan Stanley leading, and reporting from late June suggested the listing could slip into 2027. The company is building its IPO leadership team around Greg Brockman's "founder mode" consolidation — we tracked the run-up in OpenAI's revenue run rate tops $40B ahead of IPO. A company pricing that narrative carries exactly one unrepeatable asset: its growth story. Every safety slowdown costs that story, and every reorg that makes future slow-downs less likely is a gift to the narrative.

The prospectus question is therefore not rhetorical: how does an S-1 characterize risk governance when the dedicated catastrophic-risk team has been dissolved, its leader redirected, and its work distributed? Regulators and institutional investors are asking versions of that question already. The EU AI Act's Article 50 transparency rules became enforceable on August 2, requiring GPAI model providers to document training data and risk management — a compliance deadline that landed three days after the team vanished. A 42-state coalition of attorneys general has an active ChatGPT investigation, and the postmortem OpenAI promised after the Hugging Face incident is still pending. This reorg sits directly in that regulatory crosshair.

What to watch: whether OpenAI's promised Hugging Face postmortem arrives with independent evaluators' signatures; whether future model cards still report evaluations done under the Preparedness Framework, or whether the framework's name quietly disappears; whether the S-1 discloses the dissolution; and whether the next Astra update shows a "pause" that survives contact with a launch date — because that will tell us who, if anyone, now owns the no.

When a lab's catastrophic-risk team is folded into the machine it was built to watch, does the framework still count — or only the org chart? Tell us in the comments.

Sources: Financial Times · The Decoder · OpenAI — Frontier risk and preparedness · Tech Times · Wired · Future of Life Institute