OpenAI engineer arrested over a $24 conference room bug

What this video covers

• According to DOJ press release 26-1173 and an FBI affidavit, OpenAI security discovered a $23.99 Seeed Studio XIAO ESP32-S3 Sense board concealed in toilet paper in an executive conference room TV USB port on September 30, 2026.
• Prosecutors allege a chatbot account linked to the accused engineer's spouse and his own identifiers submitted prompts between September 24 and 30 on building a continuous audio recorder, encrypting the SD card, and the device's unique MAC address.
• OpenAI states it found no indication that model weights, source code, or customer data were accessed, and defense counsel states the allegations are wholly out of character and remain unproven accusations.
• Anthropic migrated its monorepo from Git to an in-house centralized version control system, Scion, in five months after merges grew from 2,500/day in May 2026 to over 30,000/day in September 2026 across 25 million daily CI checkouts.
• Mononoke co-creator Rain (sunshowers.io) compared Anthropic's Scion 'derived data' architecture with a 2022 Mononoke write-up, showing identical terminology and recursive parent-changeset blame indices.
• Cloudflare Radar found that while Yandex Search (AS13238) traffic fell 99% (93.6% verified YandexBot crawlers), unverified bots on Yandex.Cloud (AS200350) relocated to Selectel and Radist with identical JA4 TLS fingerprints.

Transcript

Why did an OpenAI room bug cost $24?

0:00 You think bugging an OpenAI executive conference room takes nation-state spyware. Federal prosecutors say an engineer used a twenty-four-dollar microcontroller wrapped in toilet paper. In this video, how did a chatbot give him away? Why did Anthropic ditch Git? And where did Russia's bots move? And keep an eye on the unattended bag in the printer room, because what he reported missing the next morning is the wildest detail in the

0:22 complaint. It's Thursday, October fifteenth, and this is The Daily Diff. The Seeed Studio Xiao E S P thirty-two S three Sense is a thumb-sized hobbyist development board with a digital microphone and an S D card slot that sells on Amazon for twenty-four dollars. According to a Department of Justice complaint unsealed Tuesday, one turned up inside OpenAI's San Francisco headquarters. Today's diff has three stories.

0:45 An OpenAI product engineer faces federal wiretap charges in San Francisco. Anthropic replaces Git after Claude pushes merges past thirty thousand a day. And Cloudflare checks whether drone strikes on Yandex stopped Russian botnets. On September thirtieth, OpenAI's surveillance

How did a $24 board land in an executive TV?

1:01 team swept an executive conference room where leadership held confidential meetings. Plugged into a U S B port on the back of the television was Recording Device One, folded inside a triangle of toilet paper. Prosecutors allege the device was planted around September twenty-eighth by thirty-five-year-old engineer Abdulrahman Alfozan, who joined OpenAI's product team last July after five years at Meta. Before the board went in, he allegedly queried an internal tool for building

1:25 addresses and executive meeting locations.

How did the chatbot prompts give him away?

1:27 Then comes the operational security masterclass. Between September twenty-fourth and thirtieth, a chatbot account tied to his spouse and sharing his identifiers asked how to build a continuous audio recorder and encrypt the S D card. It even pasted the board's unique M A C address. OpenAI says investigators used its own AI models to analyze forensic images of the device's storage and trace where it came from. On October fifth, a motion camera behind that television caught Alfozan peeking

1:54 behind the screen. OpenAI says it found no indication that model weights or source code were taken. Alfozan was arrested October ninth under the federal wiretap statute, facing up to five years in prison. His defense attorney says the allegations are wholly out of character, and an accusation is not guilt. Across town at Anthropic, the problem was Claude writing too much code for Git

Why did Anthropic replace Git with Scion?

2:13 to survive. In May, Anthropic merged around twenty-five hundred changes a day. By September, that passed thirty thousand merges a day. Their main branch history is nearly one hundred gigabytes, and continuous integration runs twenty-five million checkouts a day. Fetched naively, that would be six hundred petabytes of daily Git traffic, pushing hundreds of internal Git mirrors past their disk limits. So seven engineers built Scion, an in-house centralized version control system,

2:41 and migrated the monorepo in five months. Because coding agents stay online, Scion keeps history on Spanner and cloud storage, streaming blobs through regional memory caches with a ninety-nine percent hit rate. Anthropic says an internal snapshot of Claude Mythos Preview rewrote their Git ingestion prototype to use twenty times less memory and run four times faster. They even created Slack channels where Claude instances called superfans obsessively refresh telemetry charts for a single daemon.

Did Claude copy Meta's Mononoke?

3:08 There is just one awkward detail. Anthropic's blog post explained how Scion stores minimal changesets and recursively computes blame indices through a mechanism they call derived data. They thanked Google's Piper and Meta's Sapling for general lessons, while never mentioning Meta's Mononoke server. Yesterday, Rain, who helped build Meta's open-source Mononoke server in twenty-seventeen, posted Anthropic's paragraph beside their twenty twenty-two Mononoke write-up. Both use the exact term derived data and the same recursive

3:36 parent-changeset index for fast blame. Mononoke is open source on GitHub, right inside Claude's training set. When Rain asked Claude Opus five point five and G P T six Astra what prior art Scion resembles, both models immediately named Mononoke. Even the model knows whose homework it copied.

Did the Yandex outage stop Russian bots?

3:52 Meanwhile, Cloudflare published the postmortem on the October Yandex outage. Between October seventh and eleventh, reported drone strikes hit three Yandex data-center facilities, knocking Yandex Search traffic down ninety-nine percent and Yandex Cloud down ninety percent. Commentators celebrated that Russian bot farms had finally gone dark because automated traffic from Russia dropped eight percent. Cloudflare checked the autonomous system numbers and found the drop on Yandex Search was ninety-four percent verified search crawlers indexing news sites.

4:20 The unverified bots on Yandex Cloud simply packed their bags. On one targeted gambling customer, Yandex Cloud bot traffic dropped to zero on October eighth and immediately reappeared from rival Russian hosts Selectel and Radist with the exact same J A four T L S fingerprint. Total bot requests rose one point four percent. Which brings us back to that unattended bag in OpenAI's printer room on October

What was inside the printer room bag?

4:42 fifth. Security opened it and found Alfozan's wallet alongside a second customized recording device, which they confiscated. When he picked up the bag the next day, he reported five hundred dollars cash and his AirPods stolen, while never mentioning the missing spy bug. If you'd rather read this than hear me say it, the diff lands in your inbox every morning — free at the daily diff dot dev, link below.

What is the verdict?

5:02 So — today's verdict: REVERT. I'd revert building your covert conference-room bug by pasting its hardware M A C address into a cloud chatbot, and I'd revert claiming your AI redesigned source control without crediting the Mononoke engineers who wrote derived data eight years ago. Subscribe, hit the bell, and tell me in the comments if you'd have stamped it And that's the diff for today.

5:22 I'm Niko from Axrisi. Merge responsibly.

Sources

1. Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI (Press Release 26-1173)U.S. Department of Justice
2. OpenAI engineer arrested in bugging of executive conference roomThe San Francisco Standard
3. Who is the OpenAI engineer accused of hiding a recording device?The San Francisco Standard
4. OpenAI Newsroom statement on office recording deviceOpenAI Newsroom (X)
5. Redesigning source control at AnthropicAnthropic Engineering
6. Anthropic's Scion is heavily inspired by MononokeRain (sunshowers.io)
7. Eden Mononoke source control serverfacebook/sapling (GitHub)
8. Yandex outage: data shows that instead of going dark, malicious bots went on the moveCloudflare Blog