Someone Bugged OpenAI. How Do You Steal an AI?

A small circuit board was discovered on 30 September 2026 in OpenAI's offices. It sat behind the television in an executive meeting room, connected by USB and wrapped in toilet paper. According to prosecutors it was a recorder, and they say a second one was found five days later inside an OpenAI employee's bag. The employee was arrested on 9 October.

OpenAI's own post on 13 October has since been viewed more than 25 million times, and the FBI Director wrote that the device was allegedly meant to capture talk of the company's "super intelligence tech". Yet the case itself is smaller than that sounds: a single wiretap count for attempting to intercept conversations, and the complaint says the files on the device couldn't be recovered.

It left me asking what an outsider could actually take from an AI lab. That one week supplied three answers: plant a device in the room, copy a model by harvesting its answers, or recruit the staff and the files they carry. It follows my posts on AI cloning Adobe's apps and AI reading compiled code, and this time the thing people want to copy is the AI itself.

This is a live criminal case. Everything here about the accused is an allegation by prosecutors. He hasn't been convicted, and I'm leaving his name out.

The video version. 7 min 48 sec. Watch on YouTube

• 0:00The OpenAI recording device
• 0:52The arrest: what prosecutors allege
• 2:38Model weights: what's worth stealing
• 3:46AI distillation explained
• 5:34People and files: Apple v. OpenAI
• 7:01AI chat privacy: what it costs you

What do prosecutors allege in the OpenAI recorder case?

The criminal complaint alleges that an OpenAI engineer put a recording device in an executive meeting room he had no authority to use. Here is the sequence the filings describe, and every line of it is an allegation.

The case rests on one count under 18 U.S.C. § 2511, the federal wiretap statute: attempting to intercept spoken conversations with a device. The maximum penalty is five years in prison. Prosecutors haven't brought espionage, trade-secret or foreign-agent charges, and nothing in the filings alleges a motive or claims he worked on someone else's behalf. His lawyer describes it as a charge under a recording statute, says it has nothing to do with trade secrets or foreign agents, and told Fortune the accusations are wholly out of character.

Some of the evidence will look familiar to anyone who uses AI at work. The complaint quotes his questions to OpenAI's internal assistant. It also cites prompts asking how to build and conceal a recorder, sent from a chatbot account tied to his spouse, who faces no charges. OpenAI confirmed to Fortune that the chatbot in question was ChatGPT, and says its own models helped it identify the device. How those chats reached investigators hasn't been disclosed. They're part of a federal court record now.

What happens next

On 16 October, the docket showed a detention hearing set for 19 October, US time, which decides whether he stays in custody rather than how he pleads. Federal law generally gives prosecutors 30 days after an arrest to return an indictment, and the charges could be revised then.

What is worth stealing from an AI lab?

Mostly, a file. The weights of a model are the billions of values it settles on during training, and anyone holding them can run that model. OpenAI says it hasn't seen any sign the employee accessed model weights, customer data or source code. Still, weights are what an AI lab protects most closely.

Look at the money involved. OpenAI's March 2026 funding round valued it at $852 billion. RAND, the US research organisation, wrote in 2024 that training GPT-4 reportedly cost $78 million, while running stolen weights would cost under $0.005 per 1,000 tokens.

RAND's report ranks attackers on five levels. It places insiders on level three with organised cybercrime groups, and says level five, defences strong enough to hold off the best-resourced state hackers, can't currently be achieved.

The FBI's "super intelligence" doesn't reveal anything about OpenAI's models. It echoes a 29 September executive order that uses the phrase for AI in general, and the complaint itself calls OpenAI "a super intelligence (SI), a/k/a artificial intelligence (AI), company".

What is AI distillation?

Distillation is a way to copy what a model can do without touching its weights. A cheaper "student" model is trained on the answers of a stronger "teacher" until it responds in much the same way. In practice that means sending the teacher huge numbers of prompts, saving every reply, and using the replies as training data.

Distilling your own models is legal and routine; it's how labs make smaller, faster versions. The fight is over rivals distilling someone else's model through fake accounts. Anthropic's usage policy, for one, forbids training models on Claude's output without permission.

Anthropic reported on 12 October that new defences had reduced what distillers manage to extract from Claude by roughly 90 to 99%, while calling the result early. It had shut down accounts in the tens of thousands, often less than two hours after a campaign began. The post named Zhipu and Moonshot, both based in China, as distillers, and neither had publicly replied by 16 October. Its September threat report put the total at about 190 million exchanges, spread across five labs.

According to Anthropic, the most valuable part to copy is a model's reasoning, the working it produces before answering. A test model trained on Claude's complete reasoning scored 80.4% on a coding benchmark. Trained on summaries alone, it scored 71.8%. Protecting that working is one reason the leading labs now hide their models' reasoning or show only a summary.

What distillation defences cost ordinary users

• Some developers have had to verify their identity with a government ID to use certain OpenAI models since 2025.
• Since late September 2026, Anthropic bills for Claude requests blocked in three categories, one of which is extracting the model's reasoning. Asking Claude to spell out its full reasoning can trigger it.
• Hidden or summarised reasoning makes it harder to check how a model reached its answer.

Can AI labs stop people taking secrets when they leave?

Only partly. The federal Defend Trade Secrets Act stops a court from blocking someone's new job merely because of what they know. Taking files is another story, and that's where the lawsuits land.

In the same week, OpenAI was on the receiving end of a lawsuit. Apple alleges that engineers who left Apple brought its information to OpenAI's hardware group. On 13 October the judge told OpenAI to produce forensic images of devices, the material it used when interviewing Apple candidates, and private messages between two of the people in the case, though he refused Apple's request for OpenAI's research and development files. A day later, Bloomberg reported, the judge said an injunction for Apple was highly likely. OpenAI says other companies' secrets are of no interest to it. It also says a former OpenAI employee copied more than 100 files to personal accounts before rejoining Apple, which Apple says it found nothing to support.

Two earlier AI disputes show where these cases can end up.

Where I land

Line the three routes up and the labs are now defending against each one: sweeping meeting rooms, hiding reasoning, checking developer IDs and fighting hiring disputes in court. Most of it seems sensible to me.

The labs have good reason to protect themselves. Still, part of the price lands on people who simply use the tools: reasoning we can't see, ID checks, refusals we're billed for, and chats that can become court evidence. I'm not going to stop using these tools, but I write every prompt now as if someone might read it later.

Frequently asked questions

Sources

I read the court filings, company posts and reports available up to 16 October 2026. The case is ongoing, so check the docket for anything newer.

• The case: Criminal complaint, Penalty sheet, Motion to seal, OpenAI's post, The FBI Director's post, TechCrunch on the arrest, Fortune on the defence, Speedy Trial Act
• What's worth taking: OpenAI's $852B valuation, RAND, Securing AI Model Weights, The super intelligence executive order
• Distillation: Anthropic, distillation defences, Anthropic, September threat report, Anthropic, distillation explained, Anthropic usage policy, Claude docs on billed refusals, TechCrunch on OpenAI's ID checks
• People and files: Apple v. OpenAI, the 13 October order, Bloomberg via Claims Journal, TechCrunch on Apple's lawsuit, Defend Trade Secrets Act, DOJ on the Google engineer, Bloomberg Law, counts set aside, Bloomberg Government, the sentence, Bloomberg Law, xAI v. OpenAI