Wasn't there a thing ages ago about investment banks / finance firms having to carve out "unless you're telling the regulator" exemptions to their "you must not share any proprietary data with anyone ever" clauses?

There are interesting situations with multinational banks where actual requirements of the regulator in one jurisdiction are illegal in others. (It used to come up a lot with tax compliance in Switzerland though recently they’ve normalized them.)

>required them to waive their federal rights

I learned decades ago that contracts cannot be enforced upon illegal requests. Perhaps OpenAI has decided to leave their whistleblower compensation to the judicial system's interpretation..?

> How common/unusual is that?

I’ve never heard of it. In part because it sounds stupid: most whistleblower rights penalise retaliation. This language seems to mandate it.