OpenAI office bug arrest: scope who can see your calendars
An OpenAI engineer is charged with bugging an exec conference room after a productivity tool mapped meeting rooms and calendars. Scope your calendar access.
The alleged bug went into a USB port on the back of a TV. The reconnaissance went through a productivity tool. On October 13 an OpenAI engineer appeared in federal court, charged with trying to intercept oral communications after a recording device was found in an executive conference room. The OpenAI office bug arrest is a big-company story, but one detail applies to any business: the complaint says he used a work tool to find out which rooms the executives met in, and when.
What actually happened
CBS News reports that OpenAI employees found the device on September 30, plugged into a USB port behind a television in an executive conference room. It was hidden in toilet paper and installed about two days earlier. The room was used for confidential talks on research, product plans and business development.
Abdulrahman Alfozan, 35, an OpenAI engineer since July 2025, was arrested and made his first appearance Tuesday in the US District Court for the Northern District of California. The Washington Post reports the arrest was on October 9. Per CBS, the complaint says he used a "productivity tool" to look up building addresses, meeting rooms, room capacities, calendars and the locations of leadership and partner meetings. Security staff later found a second, similar device in a bag he left unattended.
OpenAI says it called the FBI, fired the employee, and has "no indications" he accessed model weights, source code or customer data. His lawyer says he is presumed innocent. These are allegations, and a detention hearing is set for October 19.
Why calendar access matters for your business
Most small companies give every employee, contractor and connected app full read access to every calendar. It is the default in Google Workspace and Microsoft 365, and it is convenient. It also means anyone with a login, or any AI assistant connected to one, can answer "when does the owner meet the bank, and where?"
AI assistants make that question cheap. A tool that can search calendars and room bookings for you can do it for anyone using your account. That is the same reason we told readers last month to onboard AI coworker agents like hires.
What we would check:
- Default calendar sharing. Set org-wide sharing to free/busy only. Share details with the people who need them.
- Sensitive meetings. Mark board, finance, HR and deal meetings private.
- Connected apps. List every app and AI assistant with calendar scope. Remove the ones nobody uses.
- Physical ports. Conference room TVs and displays with open USB ports are an easy place to hide a device. Look at yours.
Key takeaways
- An OpenAI engineer is charged after a recording device was found behind an exec conference room TV
- The complaint says a productivity tool was used to map rooms, calendars and leadership meetings
- OpenAI says it sees no sign of access to model weights, source code or customer data
- Default calendar sharing hands that same map to every user and connected AI tool
- Set free/busy as default, mark sensitive meetings private, and audit calendar-scoped apps
We wire AI assistants into your tools with least-privilege scopes. Your agents see what the job needs, and you get a log of what they read. Talk to us about your setup.
Sources: CBS News, The Washington Post.
- #insider-threat
- #openai
- #calendar-access
- #ai-tools
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
North Korean IT workers hit 70+ US firms: verify remote hires
DOJ says North Korean IT workers got jobs at 70+ US companies via Texas laptop farms. The FBI's checklist shows how to verify remote hires and contractors.
Read itWindows Update certificates expire in 2027: audit your PCs
Windows Update certificates expire May 17 and June 19, 2027. Unsupported or unpatched PCs lose Windows Update for good. The patch levels each version needs.
Read it