Two days after the Wall Street Journal reported that OpenAI had cut ties with three safety researchers, another safety employee has resigned and said publicly that the company's culture is broken. TechCrunch reported it on October 3.

Set the dates side by side. In late September OpenAI said its planned GPT-6.1 was too insecure to release, and it shipped a model, GPT-6.1 Sol, in its place. Ars Technica reported that the company put its IPO on hold over safety concerns. Then the safety staff began to leave. The company's stated reason for waiting and the departures of the people who do the safety work are now the same week's news.

I only have the headline-level facts on the resignation: one employee, one claim about culture. I have no further detail on what prompted it, and nothing here should be read as more than that. What the sequence does establish is smaller and more useful. A company that says safety is the reason it is holding back its public listing has lost four people from that function within days.

The person who feels this first is the chief information officer deciding whether to put an OpenAI agent near customer data. OpenAI's DevDay recap lists agents and a marketplace among its announcements. A marketplace of agents means software written by other parties, running on OpenAI's model, inside a customer's systems.

Here the security community's own warnings apply. Cryptographer Matthew Green, quoted by Simon Willison on October 1, argues that sandboxing alone may not contain a compromised agent, because a payload that hijacks one agent can be handed on to the next agent it talks to. Microsoft's security team made a related point on September 30: agents reachable through messaging apps such as WhatsApp slip past URL blocking, so firms need other controls to stop data leaving.

Both warnings point to controls the buyer has to own. AWS's published patterns for agents, including those on Bedrock AgentCore, show what that looks like in practice. In one, a bounded tool sits over a deterministic rules engine. In another, a single ask_human tool routes decisions to a person. Neither depends on a model vendor's internal safety team staying intact.

That is the part of the machine to hold onto. A vendor's safety staff reduces risk inside the vendor's own model. The approvals, the data boundaries and the limits on what one agent can pass to another sit in the customer's stack, and OpenAI's IPO delay does not change who has to build them. Any agent rollout approved this quarter on the strength of the vendor's safety reputation was approved on a team that, as of October 3, is four people smaller.