Somebody wrapped a microcontroller with a microphone in toilet paper, plugged it into the back of a TV in OpenAI's most restricted conference room, and it sat there for two days before anyone noticed.
It's the most absurd detail I read today, and it frames everything else. Today's stories are all about things leaving the room they were supposed to stay in: product plans, kids' chat logs, and, in Anthropic's newest research, model weights themselves.
OpenAI's secrets are walking out in both directions#
The FBI announced the arrest of Abdulrahman Alfozan, a 35-year-old OpenAI engineer, on Tuesday. Ars Technica's write-up of the affidavit reads like a heist film written by someone who had never seen one. According to the FBI, the device was likely planted on September 28 and found on September 30. Its storage was encrypted. OpenAI then installed a camera in the room, and on October 5 the footage allegedly showed Alfozan trying to retrieve it. He had allegedly been seen lurking outside that room on 10 different days in September.
The part that should make every engineering lead sit up is how he allegedly did the reconnaissance. In August, the affidavit says, he used an internal OpenAI productivity agent to work out where and when sensitive meetings were held. Prompts in a chatbot account linked to his spouse allegedly referenced the device's MAC address and asked how to set up speech-triggered recording and encrypt an SD card.
So the agent you give your staff to find meeting rooms will also find the right meeting room for someone who shouldn't be in it. Most internal agents I've seen deployed inherit the user's calendar and directory permissions wholesale. Nobody asks whether "who meets where, when" is itself sensitive data. Clearly it is.
If convicted on the unlawful-recording charge, Alfozan faces up to five years and a $250,000 fine. FBI Director Kash Patel framed frontier labs as a counterintelligence priority. Expect that framing to stick.
Meanwhile, the Apple fight got messier. Apple sued OpenAI in July over alleged trade-secret theft by ex-Apple staff, and on Tuesday a federal judge ordered OpenAI to hand over interview materials for former Apple employees who applied to its hardware and robotics groups, with five- and 14-day deadlines. A day later OpenAI hit back, and The Verge reports that its filing claims a former OpenAI employee took more than 100 files of product plans and presented them to Apple leadership. OpenAI even ties Apple's new HomeView smart display to that presentation, which is a stretch for a product that has been rumored for years.
Two of the most valuable hardware ambitions in tech are now accusing each other of the same thing. Whoever wins in court, the discovery process alone will drag a lot of OpenAI's device roadmap into the open.
Forty attorneys general are now reading the chat logs#
Eight states sued OpenAI on Wednesday: Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana. They filed separately but with one argument. OpenAI marketed ChatGPT as safe for young users when, the complaints allege, it was dangerous to vulnerable ones. They also accuse OpenAI of collecting minors' data. Some states want unlawfully collected data deleted, on top of civil penalties.
“OpenAI has devolved from its original mission as a public-first nonprofit that prioritized safety into a cautionary tale,” Arizona's complaint reads.
OpenAI's response is telling. It points to parental controls and break reminders, then asks for "pragmatic AI policies that apply to the entire AI industry - not just one company." Translation: please regulate us all at once, not one consumer-protection suit at a time. That isn't how state AGs work, and the eight-state pile-on shows they've figured out they don't need federal AI law to hurt you. Old consumer-protection statutes will do.
Same day, same theme: New York AG Letitia James is one of 40 bipartisan attorneys general who filed a notice in Character.AI's Chapter 11 case. Their point is that if Disney or anyone else buys the assets, the very sensitive chats of a user base full of minors can't just transfer to the highest bidder. If you run a consumer AI product, your conversation logs are now a regulated asset, both while you're alive and after you go bust.
Anthropic shows the weights themselves can become the worm#
The most technically interesting story of the day is Anthropic's warning about "small weight-based replicators". The idea is AI malware that carries its own model weights, spreads across cheap IoT hardware, and runs inference on the devices it infects. Unlike Mirai, it could work out how to attack unfamiliar devices on its own.
The experiment is more measured than the headline, and Anthropic says so:
Gemma4-26B-A4B ran sharded across 15 Android TV boxes with 4GB of memory each, at 0.39 tokens per second.
Qwen3.5-9B got other LLMs running on eight of nine hardware types.
Setting up inference took 71 to 150 hours for unoptimized Gemma and 29 to 51 hours for Qwen.
None of the small models managed full end-to-end replication. GLM-5.2, a large model, did the orchestration, and the targets had an unauthenticated Android Debug Bridge exposed.
So it isn't a working worm. But Anthropic says 30B-class models already handle many of the individual steps, and that at today's pace "small weight-based replicators may be possible soon after" the end of the year. Researcher Xiaohan Fu's caveat to Ars is fair: being able to replicate is not the same as choosing to. Still, the practical takeaway is boring and urgent. An open ADB port on a $30 TV box was always a problem. It's now a problem with an LLM attached.
It's also a pointed counterweight to this week's open-weights enthusiasm. Every small, capable, permissively licensed model is a potential payload. I don't think that argues against open weights, but it does argue for treating edge devices as if someone smart is already on them.
The fences that are actually going up#
Not everything today was a leak. Figma launched Specs, a Markdown editor where teams define their design language for both people and agents to follow, and moved code layers into public beta. Figma's chief design officer cited 17 times more code being produced but only 1.3 times more releases. That's the clearest case I've heard for constraining agents with written specs instead of more generation. YouTube Music started labelling AI tracks as Fully, Partly or No Gen AI. Deezer, which reports more than 50% of daily uploads are AI-generated, says a filter to hide them entirely ships by year-end.
These guardrails are the cheap, unglamorous kind, and they work better than the expensive ones. On the same day, White Circle researchers showed that GPT-Image-2 and Nano Banana 2 can be talked into generating nudes.
Here's my bet. Within a year, "what can your internal agent see?" will be a standard question in security reviews. The OpenAI affidavit is the case study everyone will cite. I'm auditing the calendar and directory scopes on our own assistants this week, because the cheapest exfiltration tool in the building might be the one we installed to be helpful.