14:44
Yesterday, the FBI announced the arrest of the lead engineer of OpenAI's agents platform after he bugged the executive conference room at their HQ. A story I feel uniquely qualified to cover having spent over 300 hours hiding inside a cardboard box in Metal Gear Solid. And it turns out that may be more spycraft training than the suspect had cuz despite going to Berkeley, MIT, and previously working at Meta, the guy who got arrested seems like an absolute The buggy planted was only in place for about 48 hours before OpenAI found it, and the trail he left behind was so obvious that even Gemini could have followed it. In today's video, we'll walk through the criminal complaint to find out how a guy who builds agents for a living got caught by
one, and speculate who, if anyone, he was actually working for. It is October 14th, 2026, and you're watching The Code Report. The man of the hour is Abdulrahman Alfazan, a 35-year-old Saudi national and US permanent resident who joined OpenAI in July of 2025 as an engineering lead on the product team. But just a few weeks ago, he was being celebrated as the only Saudi employee at OpenAI, where he said 1 year at the company felt like 5 years anywhere else. But which is fitting because 5 years also happens to be the maximum amount of time he'll have to keep his cheeks puckered based on the crimes he's being charged with. According to prosecutors, Alfazan's operation started about a
month ago when he used an internal agent to look up OpenAI meeting rooms along with room capacities, room calendars, and specifically where leadership and executive meetings happen, and when outside partners are expected to come in. Then between September 24th and September 30th, he used his wife's ChatGPT account to figure out how to jerry-rig a Wi-Fi-enabled audio recording device with an encrypted SD card. The model, which I assume was GPT-4.0 because there's no way his wife was getting any emotional affection from this idiot, walked him through how to make it. And based on the photos in the complaint, what he ended up with was a $23 Seed Studio microcontroller with a 50-cent antenna. And unfortunately for
Abdulrahman, the device looks like the exact thing you would use to spy on someone. And so to help with that, he went to the bathroom, grabbed some toilet paper, and wrapped it around the microcontroller to conceal it. Then, on September 28th, he allegedly committed the perfect crime when he took the $23 spy device, wrapped it in single-ply OpenAI toilet paper, and plugged it into the USB port on the back of the TV in the executive conference room. Now, if you don't have the study historical spy tech for fun form of autism, the gold standard here is a device called the thing, which Russian Leon Theremin built for the Soviets in 1945. It had no battery and no active components and
only came alive when the Soviets pointed a radio beam at it from a van across the street, which made it almost impossible to detect. They hid it inside a carved wooden seal that Soviet schoolchildren gifted to the US ambassador in Moscow as a token of friendship, and it hung on the wall inside of his office listening to four different ambassadors for 7 years before anyone found it. Abdulrahman's toilet paper bug lasted 2 days when OpenAI's technical surveillance countermeasures team found it during a routine sweep. From there, OpenAI says they used their models to understand the device and where it came
from, which sounds impressive until you remember the board has a MAC address, and 2 days earlier, Abdulrahman's wife's account had pasted the exact same one into ChatGPT. If that wasn't enough evidence, they also found security footage showing Abdulrahman hanging out near the executive room on six separate days. And just to be sure, they quietly installed a camera behind the executive room TV and waited for him to return. And on October 5th, he was back. Four days later, he was fired and arrested on the same afternoon and charged with one count of federal wiretapping and one count of being the dumbest person who ever attended MIT. Now, the one thing the complaint never says is who any of
this was for. The charge is wiretapping, which only requires proving he secretly recorded people and not espionage, which would require proving he did it for a foreign government. But, his bio does have him as an investor at RAED Ventures, a VC firm in Riyadh, where he sits on the team page right next to His Highness, Prince Khalid bin Bandar Al Saud. An investigative journalist, Scott Stedman, pointed out that the prince's father is a senior Saudi intelligence official. Either way, it's another rough look for a company that within the last few weeks has scrapped its newest model for being too deceptive and fired three safety researchers for mishandling sensitive information. And if you're
also having a rough time lately, at least your builds can be fast with Blacksmith, the sponsor of today's video. It's a drop-in replacement for GitHub runners that lets you run your GitHub actions twice as fast while costing 75% less. And they just launched CodeSmith, a cloud coding agent that knows your repos and CI runs, so you can just ask it to build something from GitHub, the web, or Slack, like I'm doing here. I'm asking it to add a new AI provider to my app and wire up the API key in my infrastructure repo. And it can open a PR in each one, then fix failing tests, or address review comments without me relaying messages between bots. You can also ask it to recommend better runner sizes from your
CI history and turn those changes into a PR. This year, you're not just renting a supercomputer to check your semicolons. Try it out for free and get 3,000 GitHub Actions minutes at the link below. This has been the Code Report. Thanks for watching, and I will see you in the next one.
