OpenAI finds hidden recording device in San Francisco office

OpenAI told employees it found a hidden recording device planted in one of its San Francisco offices, according to Business Insider, and has reported the matter to the FBI. The suspect, according to the company's account, was not a state hacking unit but an engineer employed at OpenAI itself.

The detail matters more than the headline. Security doctrine in the AI industry is written almost entirely around the outsider: state actors, network intrusions, prompt injection, datacenter sabotage. Companies warn of existential risk in Senate testimony and build elaborate perimeters around the crown jewels — model weights and training data, the assets that make a lab worth tens of billions of dollars. But the perimeter assumes the threat arrives from outside. An employee with legitimate badge access and a working knowledge of the floor plan defeats all of it with a device that costs less than a laptop.

Insider threat is the category security teams write policies about and rarely build for, because the countermeasures are uncomfortable: surveillance of one's own staff, restrictions on the very people doing the sensitive work. It is easier to fund exotic defenses against foreign services than to tell engineers they may not bring bags into certain rooms.

The open questions are the telling ones. What the device captured, how long it sat there, and — most consequentially — whether it was a lone act or a commissioned job. Model weights have a resale value that makes them the industry's number one espionage target, and a recording device in an office is the low-tech end of a spectrum that ends with exfiltrated checkpoints. The FBI's involvement suggests OpenAI at least considers the possibility that this was not a curiosity.

The company that has spent two years telling Washington its technology is too dangerous to trust in anyone else's hands did not notice a microphone in its own office.