> A chatbot account tied to Alfozan’s spouse, which shared identifiers with his own account, submitted prompts between Sept. 24 and Sept. 30 about building, installing, obscuring, and remotely accessing a recording device, prosecutors said. Queries included how to “build a continuous audio recorder” and “encrypt the SD card,” prosecutors claimed. On Sept. 27 and 28, the account asked about the specific device that was later found, including its unique MAC address.
Prepare to have that dug up 20 years in the future during some court proceedings.
Or at the border where it is already routine to ask for social media accounts (especially foreign nationals) you might someday five the border agent your login.
Just to be clear, the difficult choice is not whether to use OpenAi/Anthropic/Grok/... versus a local LLM.
The choice is whether to hang out with people with whom you can't be sure they don't have a Plaud/Pocket/.. in their literal pocket which is continuously listening.
Unfortunately the set of such people will eventually be shrinking more and more until eventually only a few tinfoil folks are left. Dystopian? Just think back w.r.t. continuous tracking by Google/Facebook/.. Unthinkable 30 years ago, total standard today. Try to count the fraction of your emails that don't actually reside on a MSFT or Google server because the other end has an account there. That fight is over. You can just as well join them.
> Spies used to put effort into these sorts of things
Assuming this is espionage—for which I have seen zero evidence—isn’t Saudi Arabia notorious for having a fuckup of an intelligence operation? The literal hatchet job that was the Khashoggi murder comes to mind.
Umm, excuse me, according to the President of the United States, he wasn't a very good guy and a lot of people really didn't like him, so you should really just let that whole incident go
That's what you get when you make a dumb prompt and accept the first result LLM gives you. You have to push it to think out of the box, get into the realm of insane but plausible projects :).
It’s the criminals that you don’t catch that you have to worry about.
The fact that even this incompetent dude most likely still made off with some secrets means I’m sure some better trained ones got/are continuing to get a few more.
Nope. He probably should've googled it (from a coffee shop, over a VPN.) There is commercial grade spy equipment that can be bought relatively cheaply and looks like every day items.
Especially since you an just buy one, like Plaud and tape it to the underside of the desk, surreptitiously, instead of suspiciously accessing the back of the TV.
I am not sure whether it bodes well for humanity that the advice "If you want to break the law use local abliterated model or at least a Chinese one" actually has to be written down.
Recall that multiple of the Chinese LLM providers got caught sending at least some of their queries to Claude. That would be a pretty funny way to get caught in turn doing something by the US government.
"OpenAI personnel found the device Sept. 30. It was plugged into a USB port on the back of a television in an executive conference room and had been concealed in toilet paper,"
I wonder what the IQ of someone needs to be to think that covering it up with tp makes it less suspicious instead of more. And I also wonder what the hiring process was like to hire someone with that mental frame.
> And I also wonder what the hiring process was like to hire someone with that mental frame.
Remember, this is only the company responsible for potentially building and aligning AGI. No need to be setting high expectations toward their sandboxing or hiring capabilities.
Given that this is being described as an "executive conference room", it's more likely an attempt at insider trading than espionage. Decisions made in those rooms at OpenAI move markets (c.f. DRAM) for sure.
OpenAI is both a company that manages a lot of money and a lot of political power, that the target was an "executive conference room" gives no indication as to whether the motives were financial or political.
What might tilt the bayesian balance in favour of political intent would be the nationality of the individual, state or religious sponsoring become hypotheses.
Honestly I think you can rule out "political" already, no? It's far easier to just bribe politicians for that kind of intelligence. My point was that they weren't stealing models, they wanted decisionmaking intel.
> "Scott Schelble, special agent in charge of the FBI’s San Francisco field office, said the agency is committed to protecting sensitive research and proprietary technology."
While the headlines and quotes seem designed to imply sophisticated industrial espionage, potentially by a state-level actor, what's public so far isn't adding up that way.
1. You're not going to get much actionable research material on proprietary technologies by audio bugging what's said in an executive conference room. That's what you'd do if you were after economic or deal negotiation info.
2. Hard to imagine a state-level actor buying a ~$15-$35 hobbyist ESP32 board from Seeed Studio (I've ordered a couple from there for home automation myself) and then asking a public chatbot for set up instructions.
3. They say he was an "engineer" who'd been there ~15 months. If you're an actual engineer at OAI and past the 1 year cliff, you're probably already sitting on RSUs likely to be worth at least $1M after OAI's IPO - and maybe much more. That's a lot of incentive to not get fired and probably makes you pretty hard to recruit as an internal mole for cash.
1. Research is not the only espionage target. High level discussions - future launch decisions, major deals signed with other companies, relationships with governments - are all very valuable.
2. An operation can be state-sponsored and still amateurish/botched. We have seen plenty of examples of these. Remember a certain bone saw?
3. The incentive can be a lot more than financial. Plenty of governments are very…persuasive.
Considering the engineer in question, after a multi-year career at Meta and now OpenAI, needed the model to encrypt an SD card, seems to not be far from the truth...
> We take protecting our technology, data, and people seriously, and as a matter of national importance.
What is there to protect? The GPT architecture is publicly known at this point, Anthropic arguably has superior models, there are dozens of other providers who are neck and neck...
Thank god security at a company which...checks notes...has remote code execution on every developers laptop and access to practically unlimited secrets uploaded by its agents...is top notch.
79 comments:
These are not very smart spies:
> A chatbot account tied to Alfozan’s spouse, which shared identifiers with his own account, submitted prompts between Sept. 24 and Sept. 30 about building, installing, obscuring, and remotely accessing a recording device, prosecutors said. Queries included how to “build a continuous audio recorder” and “encrypt the SD card,” prosecutors claimed. On Sept. 27 and 28, the account asked about the specific device that was later found, including its unique MAC address.
Learning that every thought you’ve put into an LLM, is recorded and readily available for evidence is going to be interesting for a lot of people.
Similar to how people realized their Google searches were accessible to law enforcement.
“I did not kill my wife!”
“Cool so why did you search for how to hide a dead body the same day she went missing?”
It starts far before that:
Ive seen people going through Plaud.AI conversation to find "on day X person Y said Z to person W", just to get some amunition against them.
Isn't this standard C level behaviour?
I figured any hire at openai would know that at least
I think people have some awareness, but like search history they believe deleting will resolve that (it won't).
Prepare to have that dug up 20 years in the future during some court proceedings.
Or at the border where it is already routine to ask for social media accounts (especially foreign nationals) you might someday five the border agent your login.
Ever since social media, I have always gamed out what would happen if this was ever saved on the backend and used against me in the future.
It’s like thinking about edge cases in programming…
Most people are totally not like that. And it does force you into some difficult choices.
> And it does force you into some difficult choices.
I gots to know...
Just to be clear, the difficult choice is not whether to use OpenAi/Anthropic/Grok/... versus a local LLM.
The choice is whether to hang out with people with whom you can't be sure they don't have a Plaud/Pocket/.. in their literal pocket which is continuously listening.
Unfortunately the set of such people will eventually be shrinking more and more until eventually only a few tinfoil folks are left. Dystopian? Just think back w.r.t. continuous tracking by Google/Facebook/.. Unthinkable 30 years ago, total standard today. Try to count the fraction of your emails that don't actually reside on a MSFT or Google server because the other end has an account there. That fight is over. You can just as well join them.
How far have we fallen? Spies used to put effort into these sorts of things.
When the Soviets wanted to spy on the American embassy, they energized the steel rebars to act as antennas. The structure was so wired that the entire building was the bug. https://www.airandspaceforces.com/PDF/MagazineArchive/Docume...
Toilet paper, ESP-32 and Claude "make me a bug please"? Excuse me? How far have we fallen from grace?
> Spies used to put effort into these sorts of things
Assuming this is espionage—for which I have seen zero evidence—isn’t Saudi Arabia notorious for having a fuckup of an intelligence operation? The literal hatchet job that was the Khashoggi murder comes to mind.
Umm, excuse me, according to the President of the United States, he wasn't a very good guy and a lot of people really didn't like him, so you should really just let that whole incident go
Surely this is because good spies don’t make the news.
Unless everyone's pagers start exploding
Not only that, they had Leon Theremin design some of their bugs! That's classy.
https://en.wikipedia.org/wiki/The_Thing_(listening_device)
Counter spying has gotten sloppy and mostly digital/remote.
That lowers the entry bar for basic spying.
LLMs have democratized espionage!
That's what you get when you make a dumb prompt and accept the first result LLM gives you. You have to push it to think out of the box, get into the realm of insane but plausible projects :).
And not do this from your spouse's account.
It’s the criminals that you don’t catch that you have to worry about.
The fact that even this incompetent dude most likely still made off with some secrets means I’m sure some better trained ones got/are continuing to get a few more.
Somehow is an engineer at OpenAI and before that at Meta.
Does not understand how models or data retention works.
Needs LLMs to encrypt a flash card.
Are their hiring standards that lax?
You probably don’t hear about the smart ones.
I was thinking about this, how all the secret societies and crazy conspiracies we know about are just the ones that failed to keep the lid on.
https://en.wikipedia.org/wiki/Operation_Snow_White
What portion of grand conspiracies do we think go undetected forever? Do we have any reasons for our intuitions?
The listening device was concealed with toilet paper behind a tv. Duh, Not smart at all.
Right?!
It could have just been a regular black usb stick an I bet nobody would have questioned it.
Instead "why is there something in toilet paper behind the TV?"
Hey ChatGPT, how do I do opsec? (Asking for a friend)
Nope. He probably should've googled it (from a coffee shop, over a VPN.) There is commercial grade spy equipment that can be bought relatively cheaply and looks like every day items.
> the truth is, these are not very bright guys and things got out of hand
Especially since you an just buy one, like Plaud and tape it to the underside of the desk, surreptitiously, instead of suspiciously accessing the back of the TV.
The tech industry has a lot of very capable people with very narrow domain knowledge.
Somehow they think this gives them superpowers when it's built atop a tower of borderline retardation.
Remember the Apple guy a minute ago that arrogantly thought he could bypass their security?
Also from the article:
> An unattended bag found in the company’s offices contained Alfozan’s wallet and identification, as well as a recording device
It’s almost like he wanted to be caught…
I am not sure whether it bodes well for humanity that the advice "If you want to break the law use local abliterated model or at least a Chinese one" actually has to be written down.
Recall that multiple of the Chinese LLM providers got caught sending at least some of their queries to Claude. That would be a pretty funny way to get caught in turn doing something by the US government.
Or, at the very, very least, use incognito mode on a computer you don't otherwise touch, such as at a library.
The future is already here it's just not evenly distributed.
"OpenAI personnel found the device Sept. 30. It was plugged into a USB port on the back of a television in an executive conference room and had been concealed in toilet paper,"
I wonder what the IQ of someone needs to be to think that covering it up with tp makes it less suspicious instead of more. And I also wonder what the hiring process was like to hire someone with that mental frame.
Yeah he should have just stuck a post it note with the words “do not remove” and nobody would have noticed
IT would have noticed next time they had to plug something into the TV. Whether they cared enough to figure out what it was is a different story.
> And I also wonder what the hiring process was like to hire someone with that mental frame.
Remember, this is only the company responsible for potentially building and aligning AGI. No need to be setting high expectations toward their sandboxing or hiring capabilities.
It it was _used_ toilet paper, nobody would have touched it.
> And I also wonder what the hiring process was like to hire someone with that mental frame.
What, we’re supposed to vet everyone we network with at orgies now?
Further evidence the hiring process is orthogonal to competence.
I also wonder what this guy was paid by those AI labs...
He should have just left a tape recorder running inside a briefcase that was "forgotten" in the conference room
Did you not read the article? He did that also!
Given that this is being described as an "executive conference room", it's more likely an attempt at insider trading than espionage. Decisions made in those rooms at OpenAI move markets (c.f. DRAM) for sure.
OpenAI is both a company that manages a lot of money and a lot of political power, that the target was an "executive conference room" gives no indication as to whether the motives were financial or political.
What might tilt the bayesian balance in favour of political intent would be the nationality of the individual, state or religious sponsoring become hypotheses.
Honestly I think you can rule out "political" already, no? It's far easier to just bribe politicians for that kind of intelligence. My point was that they weren't stealing models, they wanted decisionmaking intel.
This guy previously worked at Meta from 2017 to 2022 on Data Infrastructure projects.
I expect Meta are running an audit right now to figure out if he was involved in espionage back then as well.
Or maybe he’s reporting to meta?
How did they get Wonder up the benchmarks so fast? Llama was a mess
Seems possible there is some chance Alexandr knows what he's doing.
A new team, probably focused on better data.
> "Scott Schelble, special agent in charge of the FBI’s San Francisco field office, said the agency is committed to protecting sensitive research and proprietary technology."
While the headlines and quotes seem designed to imply sophisticated industrial espionage, potentially by a state-level actor, what's public so far isn't adding up that way.
1. You're not going to get much actionable research material on proprietary technologies by audio bugging what's said in an executive conference room. That's what you'd do if you were after economic or deal negotiation info.
2. Hard to imagine a state-level actor buying a ~$15-$35 hobbyist ESP32 board from Seeed Studio (I've ordered a couple from there for home automation myself) and then asking a public chatbot for set up instructions.
3. They say he was an "engineer" who'd been there ~15 months. If you're an actual engineer at OAI and past the 1 year cliff, you're probably already sitting on RSUs likely to be worth at least $1M after OAI's IPO - and maybe much more. That's a lot of incentive to not get fired and probably makes you pretty hard to recruit as an internal mole for cash.
1. Research is not the only espionage target. High level discussions - future launch decisions, major deals signed with other companies, relationships with governments - are all very valuable.
2. An operation can be state-sponsored and still amateurish/botched. We have seen plenty of examples of these. Remember a certain bone saw?
3. The incentive can be a lot more than financial. Plenty of governments are very…persuasive.
I'm out of the loop, what bone saw are we talking?
> incentive to not get fired / hard to recruit as an internal mole
but I guess the $1 million was not incentive enough to not commit a dumb insider trading scheme...
> We used our models to understand the device and where it had come from [...]
I'll be the first one to admit, that got a hearty laugh out of me. Never miss an opportunity to market your models I guess.
It would be funnier in a way if this is true and that all they do there now is ‘ask the model’ about all problems.
Considering the engineer in question, after a multi-year career at Meta and now OpenAI, needed the model to encrypt an SD card, seems to not be far from the truth...
Can anyone speculate why it was wrapped in a toilet paper roll?
That seems odd, especially since it would dampen the sound recording
Smart guy does stupid things, but why? I mean why did he, as an engineer perhaps earning north to 300k, do such a sloppy job?
Or maybe OpenAI is hiring the wrong guy? Maybe they should hire me instead?
Using your wife's chatbot account and covering a device in toilet paper is not smart when spying a company.
Chances are he'll escape back home before the trial:
https://www.propublica.org/article/saudi-fugitives-accused-o...
> We take protecting our technology, data, and people seriously, and as a matter of national importance.
What is there to protect? The GPT architecture is publicly known at this point, Anthropic arguably has superior models, there are dozens of other providers who are neck and neck...
Speaking of surreptitiously installed bugs, remember to opt out of training in your Codex.
Thank god security at a company which...checks notes...has remote code execution on every developers laptop and access to practically unlimited secrets uploaded by its agents...is top notch.
A company that catches a spy does have better security than one that has not caught any spies.
Sounds like fair use to me! Information wants to be free, remember?
Looking at the device pic in here https://sfstandard.com/2026/10/13/openai-engineer-arrested-a...
It looks like it’s the (SeeedStudio XIAO ESP32S3 Sense w/ WiFi, BLE, OV2640, Mic) https://ca.robotshop.com/products/seeedstudio-xiao-esp32s3-s...
Which is just an esp32s3 based device. I assume the word “sophisticated” in openAI report is just copy paste from device description.
Should have used a local model...
seeedstudio getting some impressive pr here for those xiao boards.
MBS using that sweet graykey behavior to exfiltrate what they can
> It was plugged into a USB port on the back of a television in an executive conference room and had been concealed in toilet paper
...uh what
>OpenAI said it has no indication that Alfozan improperly accessed or took model weights, source code, or customer data
Sounds like we know where their priorities lie, anyway.
Some more discussion: https://news.ycombinator.com/item?id=50077703
We've merged that thread hither, since current article has more background.