Small devices, big risk: what the OpenAI meeting room case means for NZ organisations

An OpenAI engineer was arrested in San Francisco on 9 October, accused of hiding an audio recording device in an executive meeting room. According to the US Department of Justice, he's charged with using or attempting to use a device to intercept oral communications. The case is before the courts, so this post is about the alleged device and what it tells us, not the person.

The complaint says OpenAI staff found the device on 30 September, plugged into a USB port on the back of a television and wrapped in toilet paper. It had been installed two days earlier, and its contents were encrypted. A second, similar device was later found in a bag he'd left unattended.

Some headlines called it spyware. It wasn't malware on a laptop. It was a small piece of hardware left in a room where senior people talk, and that's the part NZ organisations should pay attention to.

What the device appears to be

The published photos aren't high resolution, but they show enough. It looks like a small ESP32 microcontroller board with castellated edges (the half-hole pads that let it solder flat onto another board), a flat 2.4 GHz FPC antenna and what appears to be an add-on board stacked on top. Boards like this from the Seeed XIAO family are about the size of a thumbnail.

The add-on is most likely where the microphone and local storage sit. The complaint supports that. It describes chatbot prompts, from an account linked to the accused, about building a continuous audio recorder, encrypting an SD card, setting up Wi-Fi connectivity and live listening. In other words, record locally and stream out at the same time.

These boards cost less than a lunch. They're sold openly for hobby and IoT projects, they run for hours on a small battery or indefinitely from USB power, and the code to drive a microphone is freely available.

Plugging it into the USB port on the back of a television was the one smart choice. It gave the device constant power from equipment that was meant to be there. Wrapping it in toilet paper was not. Someone who knows this hardware could build it inside an HDMI cable, a dock or a conference phone, powered by that equipment, with nothing out of place to notice. This one was found. The next one may not be.

What attackers want has changed

When most people picture a compromise, they think of someone breaking into the network, pulling files off a shared drive or deploying ransomware. That still happens. But what an attacker goes after depends on what they need.

Often the most valuable information never gets written down. Board discussions, restructure plans, legal strategy, procurement decisions and incident briefings happen out loud, in a room or on a call. A device that captures the audio or video from those conversations can deliver more than weeks of network access, with far less chance of setting off an alert.

It also sidesteps most of the controls organisations have spent years building. Endpoint protection, email filtering and multi-factor authentication don't help if the information leaves through a microphone under the table.

Where AI fits

Because this happened at OpenAI, much of the commentary has been about AI. Physical attacks like this don't need AI to succeed. A cheap board, a microphone and access to the room are enough.

But this case shows where AI does help. The complaint alleges a chatbot was used over several days to work out how to build, customise, test and hide the device, including questions about its specific network settings. Someone without deep electronics skills can now get working recording and streaming code by asking for it, and once it's written it can be flashed onto as many devices as they like.

That lowers the bar. The risk itself is old. What's new is how small, cheap and easy the tools have become, and how little expertise it now takes to use them.

What NZ organisations can do

Physical security has to cover more than locks on doors. For government agencies, the Protective Security Requirements (PSR) already expect physical controls to match the sensitivity of the information handled in a space. Meeting rooms where sensitive matters are discussed fall squarely within that. For everyone else, the same thinking applies.

A few practical steps:

Know what's meant to be in the room.

Keep a simple inventory of AV equipment, cables, chargers and docks, and check it against what's there. Anything unfamiliar gets questioned.

Control where AV equipment comes from.

Buy cables, adaptors and conference kit through normal procurement, not from whoever brings one in. A spare HDMI cable left on the table is an easy way in.

Check the back of the screen.

Spare USB ports on TVs and displays give a hidden device free power. In secure rooms, any device with a USB port should have it locked, either with a physical port lock or disabled in the device settings.

Watch the wireless.

Unexpected hotspots or new devices on guest Wi-Fi near meeting rooms are worth a look, especially around sensitive meetings.

Sweep before the meetings that matter.

Board sessions, merger talks and incident briefings justify a physical check of the room beforehand. For secure rooms, go a step further: record the normal power draw of each device and check it against that baseline. A screen or phone drawing more than it should may be powering something it shouldn't.

Treat access as part of the control.

Who can get into the room unaccompanied, and when, matters as much as any technical measure. In this case, CCTV showed the accused near the room on several occasions with no reason to be there.

Brief your people.

Staff who know what these devices look like are far more likely to notice one and report it.

Remember the phone.

A detector can find a device that's transmitting, but a phone recording locally in airplane mode gives off nothing. For the meetings that matter, the real control is phones out of the room, in a tray or lockbox at the door.

Where to start

Understanding what can be used against you is the first step. Most organisations we assess have put real effort into their networks and very little into the rooms where their most sensitive conversations happen.

Liverton Security's maturity assessments cover physical security alongside information security, privacy and governance, mapped to the PSR and NZISM. If you'd like to know how your meeting rooms and physical controls stack up, get in touch.

About Liverton Security

Digital technology has greatly expanded opportunities for businesses, but has also introduced complex security threats that organisations cannot ignore. Protecting people, critical data, and entire organisations requires proactive and continuous security strategies.

As an influential and respected leader in global cybersecurity, Liverton Security specialises in helping businesses and government organisations neutralise evolving cyber threats in the digital age.