OpenAI Got Bugged With Toilet Paper. What Caught Him Was Leaving the Bug in Place.
One of the most valuable AI labs in the world got bugged with toilet paper. According to a federal criminal complaint filed in San Francisco, an OpenAI engineer wrapped an encrypted audio recorder in tissue and plugged it into the USB port on the back of a TV in an executive conference room. Employees found it on September 30. He was arrested on Friday, October 9, and made his first court appearance today. The charge is using or attempting to use a device to intercept oral communications, which carries up to five years. All of this is alleged, and nothing has been proven.
The joke writes itself. The lesson is in how he got caught, because OpenAI did the thing most of us don't do when we find something planted. They left it where it was and watched it.
What the complaint says happened
Here is the sequence as AP and the BBC report it. In the month before, hallway cameras caught the engineer near the conference room about six times, a room he had no authority to use. The room itself had no camera. About two days before the find, the recorder went into the TV's USB port. After employees found it on September 30, a camera went into the room. On October 5 that camera showed him walk in and check behind the television. The same day he left a bag unattended in another room, and security found his wallet, his ID and a second recorder like the first one. The FBI arrested him four days later.
Two more details matter. The complaint says he used an internal productivity tool to look up the company's building addresses, meeting rooms, room capacities and calendars. It also says he asked a chatbot about building, customizing, installing, testing, obfuscating and remotely accessing a recording device. OpenAI says it used its own models to work out what the device was and who had planted it. The company says it has no sign that source code, model weights or customer data were accessed or taken, and that it fired him.
What we hold on this: nothing
We checked before writing a word. There is no IP, no domain, no file hash and no package. A recorder in a TV's USB port never has to touch your network, so a firewall, an edge sensor or a threat feed has nothing to see, and that includes ours. We're saying so because a security vendor that claims everything is in its feed is selling you something. This one lived entirely in the physical world and in the company's own logs.
We also aren't going to tell you who he was working for. Coverage has leaned on his nationality. The complaint, as reported, charges one man with interception and doesn't say what he planned to do with the recordings. When a court document names a sponsor, we'll write that down too.
The trick worth stealing: leave the bait and watch it
The instinct when you find a planted device is to yank it and call someone. That destroys the one thing that can tell you who planted it, which is the person who comes back to check on their investment. OpenAI kept the device in place, added a camera, and the return visit came five days later.
That's how a canary works, and it's how we run our edge. We put fake login pages for appliances we don't own on the internet and let scanners announce themselves. A trap you leave alone tells you who's interested. A trap you clear tells you nothing. If you ever find a skimmer, a rogue access point or a planted USB device, think before you pull it. Photograph it, call counsel or law enforcement, and ask whether it can stay put under observation for a few days.
The port nobody inventories
Look at where it went: the back of a conference-room TV. That TV is the most ignored computer in the building. It's always on, it supplies free USB power, it sits in the room where the sensitive conversations happen, and no endpoint agent, asset inventory or patch cycle covers it. The same goes for the speakerphone, the room scheduling tablet by the door and the video bar. None of it needs to be hacked when a person with a badge can walk in and plug something in.
You don't need a counter-surveillance budget to close most of this. These are free or nearly free.
Disable or physically block the USB ports on room displays. Most commercial TVs have a menu setting, and port blockers cost a few dollars.
Put a five-minute look behind the display, under the table and at the power strips on someone's monthly checklist for the two or three rooms where money, deals and personnel decisions get discussed.
Keep badge and hallway camera retention long enough to look back a month. Here, the hallway footage from the month before is what tied the visits together.
Turn on audit logging for calendar and room-booking lookups, and know who reads them. An employee researching meeting rooms they never book looks a lot like reconnaissance.
If you find something, don't clear it on reflex. Leave it, watch it, and call for help.
The part that's actually new
Strip out the toilet paper and this is an old story: an insider, a bug, a return visit. What's new is that both sides used AI. The complaint says the suspect asked a chatbot how to build and hide the device, and OpenAI says its models helped identify him. The same tools that wrote his plan left a record of him writing it. If you run AI tools inside your company, their logs are a security record now, so keep them like one.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=openai-conference-room-recorder-toilet-paper-tv-usb-insider
Comments