OpenAI says it found a bug in its midst, and not the kind engineers usually patch: a hidden recording device that prosecutors allege ran on hardware you can buy online for less than the price of dinner.
Federal prosecutors claim an engineer sneaked a tiny $13.99 Seeed Studio XIAO ESP32-S3 Sense recorder into a San Francisco executive conference room. The engineer has been charged with using or attempting to use a device to intercept communications, though no plea has been reported yet. It suggests high-tech drama doesn’t always need intricate, million-dollar gadgets
According to prosecutors, the device was found around 30 September in a USB port on the back of a television, having been installed about two days earlier. OpenAI says it referred the matter to the FBI and has since fired the engineer. The investigation is ongoing.
The courtroom battle is only beginning, but the case already points to an awkward spot for any company: the meeting room, where sensitive conversations happen and physical security can get less attention than the network.
Thumb-Sized, Off The Shelf And $13.99
If you check Seeed Studio’s online store, the XIAO ESP32-S3 Sense is billed as an innocent development board complete with a dual-core chip, Wi-Fi, Bluetooth LE, a camera, a digital microphone and a microSD card slot.
It was built for hobbyist voice and vision projects, and was never intended to be a spy gadget. The complaint describes it as a thumb-sized development board with a detachable camera sensor, digital microphone and microSD storage.
That feature list is why boards like this are popular with product teams building prototypes, and it’s also why the price stands out. A microphone, wireless connectivity and removable storage on a board that’s inexpensive is a different proposition from the specialist surveillance equipment most people picture, and it’s in the same family of cheap connected hardware that’s sold openly online.
Prosecutors allege the board in this case was concealed in toilet paper and that its stored contents were encrypted. OpenAI calls the device sophisticated, but that’s the company’s description and not an independent technical assessment, and the price of the board alone doesn’t capture what the filing alleges about how it was used.
More from News
- Mhance Acquires CPS And City Dynamics To Strengthen Its Copilot, Modern Work And Business Solutions Capabilities
- What Can Startups Learn From HSBC’s AI-Driven Job Cuts?
- Moterra AI Achieves Select Partner Tier In Anthropic’s Claude Partner Network
- GoDaddy Launches Web App Hosting With API For AI Coding Tools
- 7 In 10 Consumers Have Never Investigated What’s Inside Their Smartphone
- Tango Turns Live Communities Into a Force For Breast Cancer Research
- Two Thirds of Brits Are Telling AI Chatbots Their Secrets But Don’t Trust The Companies Behind Them
- Video Game Companies Are Abandoning “Buy Our Console To Play This” – Here’s Why
The Threat That Already Has A Desk
Prosecutors claim he wasn’t authorised to enter the executive conference room but was captured on CCTV near it on multiple occasions. CCTV also allegedly shows him going into the room on 5 October, five days after the first device was found, and looking behind the television. A second, similar device was found the same day in an unattended bag in a different room.
The legal filing stresses that the room was used for confidential discussions about proprietary research, product plans, government engagements and commercial relationships. That’s alleged context from the filing and not proof of what, if anything, was recorded, and no motive has been released.
An employee already knows the building, its meeting rooms and who uses them when, which is what makes insider access hard to see coming. Fast-growing companies often add people, floors and shared rooms quicker than they add formal procedures around them, and every extra badge holder is someone who can walk past a television without anyone looking twice.
OpenAI Says Its Own Models Helped
OpenAI says it used its own models to understand the device, stating: “We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier.”
The company says its models helped analyse forensic images of the device’s storage, and that it has evidence the employee intended to deploy more recording devices.
OpenAI says it has no indications that model weights, source code or customer data were improperly accessed or taken. The complaint also describes more conventional evidence, including CCTV footage, a productivity tool allegedly used to research meeting rooms and calendars, and chatbot prompts allegedly tied to accounts connected to him.
AI is one part of the investigation as described and not the whole of it, which fits with how AI is being pulled into security work across the industry.
When The Bug Costs Less Than Dinner
The outcome will be decided in court, with a detention hearing reportedly scheduled for 19 October.
The wider point is already visible. As development boards get smaller, cheaper and more capable, the line between a hobbyist’s workbench and a boardroom keeps eroding, and any company with valuable conversations to protect shares that exposure.
OpenAI is the name in the headlines because of what it builds, but the hardware in this case sells to anyone.
