Skip to main content
Close
Security

Recorder in OpenAI's executive room: the perimeter nobody models

Gabriel Ferraresi· CEO | Tech86October 29, 20263 min
physical-securityinsider-threatopenaiaicounterintelligence

The company that says it is building super intelligence found a recorder hidden in toilet paper on the USB port of the TV in its executives'' room. Whoever planted it, per the federal charge, is one of OpenAI''s own engineers. And he asked a chatbot how to build the bug.

I will go by what the Department of Justice published, because the rest is imagination.

The case timeline

The device was installed around September 28 in OpenAI''s executives'' room in San Francisco. Employees found it on September 30: plugged into the back of the TV, covered by toilet paper, encrypted content. The arrest came on October 9.

The accused is Abdulrahman Alfozan, 35, an engineer at OpenAI since July 2025. The charge is using a device to intercept oral communications. If convicted: five years and a 250 thousand dollar fine.

The room was not just any room. It frequently handled proprietary research, product plans and non-public information about technical progress, priorities and government engagements.

The first failure: access control

He had no authority to enter that room, and cameras showed him near it on several dates. Before planting the device, he searched an internal tool for rooms, calendars and executives'' locations.

Physical access without screening, corporate schedules exposed to people who do not need them, and executives'' locations queryable internally: each of those is a control that exists on paper and that the case showed broken in practice.

The second failure: the conversation with the model is recorded

A chatbot account associated with his wife, which shared several identifiers with his own account, sent prompts between September 24 and 30 about building, installing, testing, obfuscating and remotely accessing a device: a continuous audio recorder, customizable Wi-Fi, live listening and SD card encryption.

The same chatbot asked about the custom header and the unique MAC address of the device found in the room. Let that sink in: the man allegedly asked an AI model how to build the bug, and then asked the model for the bug''s MAC address. His questions are now federal evidence.

The part that closes the case

It came on October 5. Cameras showed him returning to the room to look behind the TV, after the discovery. That same day, he left a bag unattended in another room: inside, along with his wallet and ID, a second identical recorder.

OpenAI''s response: it says it used internal AI models to identify the person responsible and trace the origin. The alleged bug designed with AI help was dismantled with AI help. There is no indication of unauthorized access to model weights, code or customers.

The government did not treat this as a police report. The director of national intelligence spoke about winning the super intelligence race, and the FBI''s director called the case a counterintelligence priority.

Conclusion

Two lessons for anyone operating technology. The physical layer is still the one nobody models: the industry''s most watched perimeter was beaten with toilet paper and a USB port. And the conversation with the model is recorded: when the question is how to build a bug, it stops being a draft and becomes testimony.

Interested in this solution?

Explore our managed services and infrastructure.

Security Awareness Program

Frequently Asked Questions

According to the Department of Justice, one of the company's own engineers, Abdulrahman Alfozan, 35, at OpenAI since July 2025, installed a listening device around September 28 in the executives' room in San Francisco. Employees found it on September 30: plugged into the back of the TV, covered by toilet paper, with encrypted content. The arrest came on October 9, and the charge is using a device to intercept oral communications, carrying up to five years and a 250 thousand dollar fine.

On both sides. The charging documents show that a chatbot account associated with the accused's wife, which shared several identifiers with his own account, sent prompts between September 24 and 30 about building, installing, testing, obfuscating and remotely accessing a device: a continuous audio recorder with customizable Wi-Fi, live listening and SD card encryption. The same chatbot asked about the custom header and the unique MAC address of the device found in the room. And OpenAI says it used internal AI models to identify the person responsible and trace the origin.

There is no indication of unauthorized access to model weights, code or customers, according to the case itself. The room, however, frequently handled proprietary research, product plans and non-public information about technical progress, priorities and government engagements, and the FBI called the case a counterintelligence priority.

That the physical layer is still the one nobody models: the industry's most watched perimeter was beaten with toilet paper and a USB port. The implant broke no cryptography; it operated in the layer digital controls cannot see. The executive room is a counterintelligence asset, and its power points are attack surface.

Two things. First: sensitive prompts are corporate records and they are recorded, which demands an acceptable use policy as rigorous as email policy. Second: identifier correlation across accounts is what solved the case, and it is the same job [identity architecture should do inside companies](https://www.tech86.com.br/en/blog/ciso-espelho-quebrado-proatividade-fachada-estrutura). The industry's previous case, the [OpenAI breach with no CVE](https://www.tech86.com.br/en/blog/openai-invadida-com-claude-zero-cve), already pointed out that the new AI vector lives on the edges nobody inventories.

Blog, Get in Touch

Have a question about our articles or services? Our team is ready to help.

Schedule a Meeting

Book a time slot.

Schedule Now

Email

Send us a message.

[email protected]

WhatsApp

Quick conversation.

Address

Avenida Paulista, 1636 - São Paulo - SP - 01310-200

Tech86 Specialist

Online now

Hello! How can we help scale your business today?

Tech86 Engineering

We Value Your Privacy

We use cookies and similar technologies to optimize your experience, analyze site traffic, and personalize content. By clicking "Accept All", you agree to the use of all cookies. Read our Privacy Policy.