It sounds like the stuff of which spy thrillers are made: US authorities charged an OpenAI employee — Saudi national Abdulrahman Alfozan — with planting a secret recording device in an executive meeting room in the company’s San Francisco offices.
The listening device was found plugged into the back of a wall-mounted monitor, so as to eavesdrop on discussions between senior leaders at the company. OpenAI said it did not believe any of its source code, model weights or customer data had been compromised by the breach.
As more details emerge about the incident, though, the more it resembles a comedy of errors. According to the Department of Justice, someone using an account linked to Alfozan repeatedly asked an AI model for assistance in developing his attack, with prompts including asking how to “build a continuous audio recorder,” “customize WiFi…connectivity,” “improve audio and live listening” and “encrypt the SD card.” Alfozan even appears to have been caught staring directly at a surveillance camera as he checked behind the screen.
This incident is unlikely in itself to represent a major security breach against OpenAI. Instead, it is telling as a reminder of the stakes at play as frontier AI companies end up operating some of the most sensitive sites for the USA’s national and economic security — conducting medical research, defense operations and cutting-edge technological research. Have the companies developed the internal procedures to manage the risks of their own operations?
Nothing in the reporting to date suggests who Alfozan was allegedly spying for, but there is no shortage of possible culprits: foreign nation states, overseas companies looking to catch up on OpenAI’s lead at the frontier, or even a domestic rival looking for financial or commercial advantage — given the bug was placed in a boardroom, rather than among developers.
But while the apparent ineptitude of the operation might initially seem reassuring, the reality is likely quite different: this is the case that we know about. Alfozan had been employed by OpenAI since July 2025. His chatbot queries began on September 24 of this year. The bug was allegedly placed on the 28th and discovered on the 30th. The FBI claims he attempted to install a second device in a different room a week later, before finally being arrested on October 9.
All of which raises the question: if someone running an operation so basic that — while working for an AI company — they were asking their chatbot for assistance managed to operate for weeks without detection, what does that say about more competent operators?
When Edward Snowden leaked classified NSA and GCHQ documents to the Guardian and Washington Post, external commentary focused on how a breach of such a scale could have possibly taken place — with some worrying that Snowden himself was passing material to the Russians.
More experienced (and quieter) counterespionage and cybersecurity professionals worried more about what it revealed about what sophisticated adversaries such as China and Russia must have been able to exfiltrate, far more quietly than Snowden ever did. There is a clear parallel at play here: Alfozan is the case that we know about. If he was operating in this way, there can be virtually no doubt that more sophisticated actors are targeting the same companies, almost certainly with more success.
This incident is both a wake-up-call and totally unsurprising. US big tech giants have faced serious risks from industrial espionage for the last two decades, and have sophisticated security teams to monitor it at all times, alongside often laborious — and sometimes irritating — procedures for staff. That is just part of the reality of being a large corporation in 21st century America.
The trouble for OpenAI and Anthropic in particular is that they are speedrunning a course set by the technology companies that came before them. OpenAI is only 11 years old, while Anthropic is not yet six. Both are still startups in a very meaningful sense, not least that they are still burning through cash.
But both have become even more significant to the US and global economies than Microsoft, Google or Facebook did on similar timescales. Even just focusing on their current capabilities and financials, they are integral to US economic growth. Their revenue and userbase growth since the launch of their first products is without precedent. Beyond that, they have both already worked as defense contractors, working on sensitive national security projects and developing tools that could be extremely dangerous in the wrong hands.
All of that gives them a level of responsibility far beyond that of any startups that have gone before, and that’s before you look at the potential capabilities of frontier models in the next two to five years — or the questions of existential risks that have so animated the sector over the past summer. The threat profile for AI companies demands an approach to security that their corporate cultures have not yet evolved to provide.
This problem of culture has been specifically highlighted by departing OpenAI employees, most notably by David Robinson, who led on transparency work for OpenAI’s safety team, in an article for The Atlantic earlier this month. Robinson noted the company’s “can-do” culture and constant sprints had proven highly effective in building bigger and better systems — but falls short on safety.
“The safety approach that emerges from such a culture starts with unimpeded optimism about being able to solve problems as they arise,” he wrote. “Given today’s risks, frontier companies need to run like nuclear-power plants or busy airports, with layers of redundancy and careful, time-consuming planning, so that the occasional and inevitable human error does not open a door to disaster. Right now, AI companies don’t know how — but other people do.”
A startup culture suits the pace of technological change OpenAI and Anthropic are trying to manage — but it is also often incompatible both with their financial scale and the capabilities of their technology.
The cases over the summer of OpenAI agents autonomously hacking Hugging Face, and the flurry of reported incidents from OpenAI and other companies that followed it, prompted an appalled reaction from senior cybersecurity professionals — people who were not so much shocked at the capabilities of the models, but at the lax way in which the companies involved were doing security research.
One senior official, speaking to Transformer on background due to his ongoing involvement in the industry, likened AI companies’ security research to “discovering someone was doing bioweapons research in their kitchen, and saying it was okay because they’d washed their hands.”
Running a major frontier AI lab is clearly among the most challenging jobs in the world: keeping investors and lenders onside, handling would-be regulators, trying to turn AI into a consumer product, all while doing cutting-edge research, is challenging enough.
But the reality is that no major AI developer can afford to have a startup culture anymore — “move fast and break things” was bad enough for social media. It simply will not be tenable for technology of AI’s potential.
It is perhaps the least flashy thing AI companies could do, and surely not where executives would want to put their focus, but building the kind of stolid corporate infrastructure and safeguarding is likely the only way for them to handle the mounting problems that come with their scale — of developing safe research protocols, of handling insider and outsider threats, and of managing the surely endless wave of liability lawsuits.
Nothing is less cool than corporate stodginess. All the same, it might be exactly what OpenAI and Anthropic need right now.
