On 13 October 2026, the US Department of Justice announced charges against an OpenAI engineer accused of hiding a covert audio recorder in an executive conference room at the company's San Francisco offices. According to the Justice Department's announcement, the device was plugged into a USB port on the back of a television and concealed in toilet paper. The engineer has been charged with using, or attempting to use, a device to intercept oral communications. The charges are allegations, and he is presumed innocent unless proven guilty.
What happened, according to prosecutors
The Justice Department sets out this timeline:
- July 2025: the engineer joins OpenAI.
- Late September 2026: a chatbot account linked to his household allegedly asks how to build, install, record with and hide an audio device. In the run-up to the installation, he also allegedly used a productivity tool to look up building addresses, meeting rooms, room capacities, calendars, executive locations and partner meetings.
- 28 September: the device is allegedly installed behind the TV in the executive conference room, a room he had no authority to enter. CCTV is said to show him near the room on several occasions.
- 30 September: OpenAI staff find the device. Its contents were encrypted.
- 5 October: he allegedly returns to the room and looks behind the television. The same day, security staff find a second, similar device in a bag he left unattended.
- 9 October: he is arrested by the FBI.
Prosecutors say the room hosted discussions of confidential technical, commercial and strategic information. The announcement does not say whether any audio was captured or sent anywhere. If convicted, he faces up to five years in prison.
Why this case matters beyond the tech industry
1. The threat came from inside
The suspect was an employee with a building pass. Most bugging cases follow the same pattern: the device is placed by someone who already has access, such as staff, contractors, cleaners, visitors or former insiders. Perimeter security and access badges do not stop a person who is allowed to be in the building.
2. The device was ordinary and powered
A USB port on the back of a television is an ideal hiding place: it provides permanent power, it is out of sight, and nobody looks behind a screen. It matches the pattern of documented cases, with devices built into USB chargers and docking stations, and plugged into AV equipment.
3. The target was the executive conference room
The device was not placed at random. Prosecutors say the suspect researched where executives met and when. Boardrooms and executive meeting rooms are where strategy, transactions and partnerships are discussed, which is why they are the first place a professional sweep looks.
4. It was found, but not every company would find it
OpenAI found the device within days. Many organisations would not, because they have no routine for checking their sensitive rooms. A device that records locally does not transmit, so it will not show on a simple RF detector; see do bug detectors work?.
Five lessons for any boardroom
- Sweep the rooms that matter on a schedule, and before high-value meetings, not only after a suspected leak. A recurring programme gives you a documented baseline.
- Check AV and USB points. Look behind screens, at the USB ports on TVs and conference systems, and at anything plugged in that nobody owns.
- Control access to executive rooms. Lock them when not in use and review who can enter.
- Treat CCTV and access logs as part of security. In this case they helped build the timeline.
- If you find a device, do not remove it in a hurry. Document it, preserve it and get advice. See what to do if you find a listening device.
How Bureau Securitas can help
Our two-person teams carry out office and boardroom bug sweeps in London and every EU capital, using RF spectrum analysis, non-linear junction detection, which finds electronics even when they are recording silently, thermal imaging and a physical search of furniture, fittings and AV equipment. Planned sweeps typically cost €2,500–5,000 per team-day plus travel, with a fixed written quotation first.
Contact us from a safe device at tscm@bureausecuritas.com. NDA on request.
*Source: U.S. Department of Justice, Office of Public Affairs, 13 October 2026. The charges are allegations; the defendant is presumed innocent unless and until proven guilty.*
Frequently asked questions
What happened in the OpenAI bugging case?
US prosecutors allege that an OpenAI engineer hid a covert audio recorder in the USB port of a TV in an executive conference room in San Francisco in September 2026. Staff found it on 30 September, a second device was found in his bag on 5 October, and he was arrested on 9 October.
Where was the recording device hidden?
According to the Justice Department, it was inserted into a USB port on the back of a television in an executive conference room and concealed in toilet paper.
What is the lesson for companies?
Most bugging is done by people who already have access. Companies should sweep executive meeting rooms on a schedule and before high-value meetings, check AV equipment and USB points, and control access to sensitive rooms.
Would a bug detector have found the device?
Not necessarily. Devices that record locally do not transmit, so a simple RF detector can miss them. Professional sweeps use non-linear junction detection and a physical search to find electronics that are not transmitting.