OpenAI said it has found a hidden recording device in one of its offices and has referred the matter to the FBI. One of its employees has been arrested.
In a statement on Tuesday, the San Francisco-based AI company said it discovered the “sophisticated recording device” and used one of its “models to understand the device and where it had come from”.
The company has identified “that a specific employee had planted it a few days earlier”, adding: “At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.”
Abdulrahman Alfozan, 35, a Saudi national, was arrested on 9 October, according to a press release from the US Department of Justice.
Alfozan allegedly plugged an encrypted recording device, concealed within toilet paper, into a TV in an executive conference room in OpenAI’s San Francisco headquarters on 28 September. Meetings in the room regularly covered confidential information, the FBI’s press release said. A security sweep conducted two days later revealed the device, according to the justice department. Surveillance footage allegedly documented him walking around the meeting room in the days leading up to its discovery.
According to the indictment of Alfozan, he submitted multiple prompts to an AI chatbot about internal details of OpenAI – “building addresses, meeting rooms, meeting-room capacities and calendars, ‘leadership and exec’ locations”, according to the FBI.
His spouse allegedly submitted multiple prompts to chatbots about “building, customizing, installing, audio recording, testing, obfuscating, and remote accessing a device”, with specific inquiries about “‘build[ing] a continuous audio recorder,’ ‘customiz[ing] wifi … connectivity,’ ‘improv[ing] audio and live listening,’ and ‘encrypt[ing] the SD card’”.
The same chatbot account allegedly made inquiries that referenced unique identifiers of the device discovered in OpenAI’s offices. After searching a bag left unattended by Alfozan in the headquarters, FBI agents discovered a second identical recording device, according to the indictment.
If convicted, Alfozan faces five years in prison and up to $250,000 in fines. He has not made a public comment regarding the indictment.
OpenAI said that it is “grateful to the agents and prosecutors who moved quickly to make an arrest” and the investigation is continuing.
The company added: “We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.”
The incident adds to a growing list of privacy controversies for OpenAI. In June, an agent hacked Australia’s university healthcare system, and earlier this month, California attorney general Rob Bonta issued an investigative subpoena to OpenAI over rogue hacking.
Last week, OpenAI announced it had terminated three safety researchers for allegedly sharing sensitive information in what the company called “a breach of trust”.
“They violated clear policies on handling sensitive information,” a company statement read.
The trio of researchers called on the company to adhere to its own promises of transparency made in the wake of the autonomous hacking incidents.
Meanwhile, Sam Altman, the OpenAI CEO, said in a recent interview that the world should accept “bad things” happening with AI in exchange for its benefits. Around the same time, David Robinson, a top safety leader resigned from the company, citing a “broken” company culture and warning that AI developers are not “being nearly careful enough” with the rapidly advancing technology.
