Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident
Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Patrick Gray and Amberleigh Jack. This week's edition is sponsored by Sondera.
You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your podcatcher or subscribing via this RSS feed.
A Saudi Arabian OpenAI employee has been arrested and charged with bugging an executive conference room in one of the company's San Francisco offices. But this story is weird! WEIRD!
The US Department of Justice (DoJ) alleges that Abdulrahman Alfozan hid a recording device by plugging it into the USB port of a television. The DoJ says the conference room was used for discussion of "highly confidential" technical, commercial and strategic information.
That is serious, but the way Alfozan allegedly tried to launch his spying career is almost comically amateur.
According to the criminal complaint, the bug was a small SEEED brand microcontroller development board, with camera, microphone and wifi connectivity, that retails for USD$13.90. OpenAI examined the device and assessed it may have been modified to encrypt data to prevent forensic analysis. Best of all, the device was "concealed in toilet paper".
In separate court filings the DoJ alleges that in the days prior to installing the device, Alfozan used his wife's personal ChatGPT account to research how to build a continuous audio recording device. The prompts provided to the chatbot included asking about encrypting recordings and configuring the device for USB power-only operation. Alfozan also used his own ChatGPT account to find out the best meeting rooms to target at OpenAI.
Alfozan also left a bag containing another recording device unattended in an OpenAI printer room. By then, though, the company was aware of his activities and found and confiscated the device after searching the bag. That unattended bag with the recording device also contained personal items including Alfozan's wallet and ID. Clever.
Alfozan was arrested a few days before he was scheduled to travel to Riyadh to take two months of parental leave, and the DoJ alleges Alfozan has strong links to Saudi Arabia.
According to documents tendered to the court, Alfozan was in "frequent communication" with a member of the Saudi Royal Family via WhatsApp. That individual encouraged Alfozan to join an AI initiative that was being launched in Saudi Arabia, saying "Saudi needs you more then [sic] the US!".
The kingdom's government does appear to like this guy. It paid for tickets to repatriate his wife and child after he was arrested.
With all that in mind, we don't think this is state-backed espionage, at least in the traditional sense. By arming himself with illicitly obtained commercially sensitive information, we think Alfozan was probably just trying to juice up his appeal as a hire back home. And his homie in the royal family would also presumably be impressed when he returned to Saudi Arabia toting a bag full of OpenAI conference room recordings. Everyone wins!
Even though this incident doesn't bear the hallmarks of a state run espionage operation, we're certain that intelligence services are targeting the frontier labs. More than three years ago we wrote about how the NSA wanted to protect America's AI edge, and it's even clearer now that AI technology is central to geopolitical competition.
Unfortunately, the incentives for companies to move fast to stay ahead of the competition are not conducive to strong security. We've already seen a spate of embarrassing AI security incidents where frontier lab models successfully embarked on overenthusiastic hacking adventures. In our view, these are directly downstream of a culture that prioritises speed over security.
Mitigating insider threats and state-level espionage risks is an arduous undertaking. Intelligence agencies' mitigations, for example, include lengthy and extensive personnel vetting, strict access control, behavioural monitoring and years spent developing a strong security culture.
Likening a frontier AI company to an intelligence agency may seem like a stretch, but the reality is these labs are top priorities for state espionage. And we don't think strong insider threat programs are compatible with the pace at which AI companies are moving.
When it comes to the labs themselves, this incident needs to serve as a wake up call that they need to improve their operational security. If a clown like Alfozan can get a listening device into a conference room, what could a sophisticated actor do? Those spies won't be wrapping off-the-shelf cameras in toilet paper. Instead, they could be remotely compromising that conference room smart TV, and they'll be far harder to catch.
So while intelligence agency-level insider threat controls are unlikely to be implemented at the frontier labs, they will need to work harder to protect their crown jewels.
Watch Out, Cybercriminals! AI Is Coming for Your Jobs, Too
Security firm NorForge has released a report detailing how various threat actors are using the Cairn autonomous pentesting agent in financially-motivated cybercrime. And they're actually making bank.
This is a pretty stark contrast to some of the other AI-assisted escapades we've written about in recent months. In those examples, the threat actors successfully used AI to do the hacking, but were hopeless at making money out of the access they obtained.
Cairn is an open source project, described by its maintainers as a "general-purpose AI state-space search engine". When given a starting point and a goal it tries to search out a path between A to B. Cairn is well suited to penetration testing, for example. There's a clear starting point, such as an IP or a system, and a concrete measure of success, like getting a shell. The project's documentation says it also works well for vulnerability research and mathematical proofs.
Cairn is not the only harness being used to do malicious AI hacking, but it is often configured with an unsecured web-based user interface, making it visible to tools like Shodan. NorForge was able to find 20-ish open Cairn panels that were being used to conduct malicious hacking campaigns.
The largest operation NorForge identified was a single Chinese-language cluster of 14 Cairn dashboards running over 1100 attack projects. This cluster mostly targeted the American, Japanese and Australian retail and wholesale sectors, with an apparent goal of gaining persistent access to e-commerce payment infrastructure. So, AI-driven hacks are providing access to credit card and payment details.
A second, English-language cluster was less prolific. This set of panels was focussed on payments and financial services crime, with a similar goal: Steal information that can be converted immediately into money.
The final cluster was smaller and focussed on a mix of e-commerce sites and very large US-based commercial platforms.
Overall, NorForge reckons that about 10% of the hacks being managed by Cairn were successful, and they averaged less than 24 hours to complete. There were indications that two of the clusters were using DeepSeek models that are relatively cheap to run. Snorre Fagerland, one of the report's authors, told Reuters he estimated the cost was roughly USD$50 per successful hack. Decent bang for buck, then.
Some of the actual hacking was also quite impressive. Per Reuters:
In one case, after failing to find any weaknesses in a big company's public-facing application, the AI agents pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in the way it processed data, and after hours of trial and error, reported leveraging it to trick the server into executing malicious commands.
To us the significant thing here is that threat actors have found a target set where they can automate the entire process, from hacking a site to transferring a victim's cryptocurrency to an attacker-controlled wallet. Old-school cybercriminals should be worried. AI is coming for their jobs!
Watch Amberleigh Jack and Tom Uren discuss this edition of the newsletter:
Three Reasons to Be Cheerful This Week:
- AI safety on the agenda: The US Federal Trade Commission has issued subpoenas to leading AI companies asking for documents relating to the firms' security incidents and their safety practices, reports Axios. This comes after the White House Super Intelligence Force mandated earlier this month that companies must notify and remedy security incidents involving government systems.
- Triple strike against the Chinese cybercrime ecosystem: An international collaboration including Microsoft, Japan's National Police agency and the Health-ISAC has taken down three Chinese cybercrime services. CoGUI and Iron Man sold phishing kits while the YAM Store sold compromised accounts. Microsoft says that the kits have sent more than a billion malicious messages since January.
- Chrome gets ClickFix protections: Google has announced a range of improved security features including suspicious site warnings, improved scam detection and protections against ClickFix attacks.
Sponsor Section
In this Risky Business sponsor interview, James Wilson chats with Sondera co-founder and CEO Josh Devon about how AI agents are highly capable, but they’re not the best rule followers or decision makers.
Shorts
A Bad Time To Be A Russian Data Centre
Ukrainian drones struck a data centre operated by Russian social media giant VK on Sunday. Although VK says services are available as usual, internet monitoring firm Netblocks says VK network activity dropped by 44 percent after the strike.
This follows on from our article last week discussing the impact of Russian attacks on Ukrainian data centres. Russia's efforts to build a sovereign internet make it more vulnerable to Ukrainian retaliation.
Risky Biz Talks
You can find the audio edition of this newsletter and other fine podcasts and interviews in the Risky Biz News feed (RSS, iTunes or Spotify).
In our last "Between Two Nerds" discussion Tom Uren and The Grugq discuss whether the rise of AI coding will result in more or less bugs and whether it will ultimately make software more secure.
Or watch it on YouTube!
From Risky Bulletin:
Hacker hijacks 10% of Tor exit nodes: A mysterious threat actor has hacked more than 330 Tor servers earlier this month to carry out a mass-sniffing campaign against Tor users.
The attacker hacked Tor relays, infected them with the Ebury Linux malware, and converted them to exit relays where it could intercept SSH connections and downgrade email connections to steal unencrypted email traffic.
The hacking campaign went undetected for three days, between October 2 and 5, before it was spotted by a Swiss engineer and reported to the Tor security team.
[more on Risky Bulletin]
PwnEscape vulnerability lets you escape KVM: The Linux kernel team has patched a major vulnerability that lets virtual machine guests escape the KVM Linux virtualization module and run code on the underlying host operating system.
Codenamed PwnEscape (CVE-2026-99999), the bug occurs because the Linux networking stack allows the VM guest to modify IP packets after they've already been validated as safe by the kernel. This allows a skilled malicious guest to read host memory and potentially modify it for code execution.
PwnEscape impacts KVM running on x86 CPU architectures, which is the most common setup used by most shared cloud environments.
[more on Risky Bulletin]
Russia arrests DataSuckers hacking group: Russian authorities have arrested three members of DataSuckers, a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space.
Authorities say the group has four members in total, spread across Russia, Belarus, and Kazakhstan. A 19-year-old named Denis A. Friedman, from the city of Barnaul, was arraigned in a Moscow court on Wednesday, but no other details were provided on the other two detained suspects.
DataSuckers started operating this year and has been linked to at least three major hacks—Ukrainian super market chain ATB Market, Russian travel company Tez Tour, and Russian pizza chain Dodo Pizza.
[more on Risky Bulletin]
