[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcoY5rE4oFo81fvazAw6kmRgMwKzXPsZTI0HPPoG9yOg":3},{"article":4,"iocs":52,"watch_terms":56,"solutions":57,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"b86c04c4-1bc2-48f5-94fc-8e1a3c884a62","An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office","an-openai-employee-allegedly-used-a-chatbot-to-help-plant-a-recording-device-at--d1479a","Chatbot prompts reveal the engineer’s alleged efforts to set up a covert listening device days before one was found in a meeting room used by high-level executives.","An OpenAI engineer, Abdulrahman Alfozan, is accused of using AI chatbots and internal tools to plan the installation of a covert audio recording device in an executive conference room. The device, allegedly concealed in toilet paper, was discovered during a security sweep. Prosecutors suggest the motive was to capture sensitive communications about the company's 'super intelligence technology,' though OpenAI has stated there's no indication of model weights, source code, or customer data being accessed.","OpenAI engineer accused of using AI to plan planting of listening device at company.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fan-openai-employee-allegedly-used-a-chatbot-to-help-plant-a-recording-device-at-the-office\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6aceab66cc5b61e4cd2bfb17\u002Fmaster\u002Fpass\u002FMan-Arrested-for-Listening-Device-in-OpenAI-Office-Security.jpg","2026-10-13T23:17:59+00:00","2026-10-14T00:00:07.828606+00:00",8,[17,20,23,26],{"name":18,"type":19},"Abdulrahman Alfozan","threat_actor",{"name":21,"type":22},"OpenAI","vendor",{"name":24,"type":25},"Seeed XIAO ESP32-S3 Sense","product",{"name":27,"type":28},"AI chatbot","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":24,"context":55},"malware","Sophisticated recording device allegedly used in the incident.",[21,24],{"controls":58,"vendors":143},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":110,"product_name":111,"url":112,"description":113},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":115,"name":116,"problem":117,"products":118},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":162},"insider-threat-openai-engineer-allegedly-plants-covert-recording-device-using-ai-tools","Insider Threat: OpenAI Engineer Allegedly Plants Covert Recording Device Using AI Tools","A trusted insider allegedly leveraged AI chatbots and internal company tools to plan and execute the covert installation of an audio recording device targeting executive communications — a textbook insider threat scenario. The incident highlights that technical controls alone are insufficient when privileged employees can exploit their access and organizational knowledge to bypass physical and digital security boundaries. The use of AI tools to assist in planning the act adds a new dimension of concern, as these tools can lower the skill barrier for malicious insiders. Physical security sweeps ultimately detected the device, underscoring the importance of layered physical and logical monitoring. This case demonstrates that insider threats require continuous behavioral monitoring, strict need-to-know access principles, and robust physical security protocols especially around sensitive spaces.",[149,150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 IR-8: Incident Response Plan","NIST SP 800-53 PE-3: Physical Access Control","NIST SP 800-53 PS-7: External Personnel Security","NIST Cybersecurity Framework DE.CM-3: Personnel Activity Monitoring","CISA Insider Threat Mitigation Guide","ISO 27001 Annex A.7: Human Resource Security","ISO 27001 Annex A.11: Physical and Environmental Security","ITIL Service Transition: Change and Access Management",{}]