Your Prompts Are a Record: What the OpenAI Bugging Case Shows

On September 27 and 28, someone used a chatbot account to ask about a specific recording device: its custom header and its unique MAC address. Two days later, OpenAI staff found that device plugged into the back of a television in an executive conference room in San Francisco, concealed in toilet paper.¹ Those prompts are now in a federal criminal complaint.

The Justice Department unsealed the complaint on October 13. It charges Abdulrahman Alfozan, a 35-year-old engineer OpenAI has since fired, with using or endeavoring to use a device to intercept oral communications, in violation of 18 U.S.C. § 2511(1)(b).¹²³ He’s charged, not convicted. OpenAI’s own statement leads with AI: it says its models traced the device to a specific employee.² That may be true, but neither the DOJ release nor the FBI affidavit behind the complaint mentions AI, and the device itself turned up in a physical sweep. The part worth your attention is quieter: a chatbot account’s history is sitting in a charging document as corroborating evidence, tied to the defendant by the identifiers the account shared with his own. Prompts are records. They have retention windows, legal process attached to them, and metadata that links them to people. Most of us don’t treat them that way.

What We Know

What the complaint alleges, and what it leaves out

The DOJ release lists four strands of evidence.¹

Strand	What the release says
CCTV	He appeared near the executive conference room on multiple dates before the discovery, with no authority to be in its meetings
Productivity tool	Before Sept 28, he queried building addresses, meeting rooms and their calendars, “leadership and exec” locations, and external partner meetings
Chatbot account	An account “associated with Alfozan’s spouse (which shared multiple identifiers and attributes with Alfozan’s own chatbot account)” sent prompts Sept 24 to 30 about building, installing, obfuscating and remotely accessing a recorder, including “encrypt[ing] the SD card”
Second device	On Oct 5, security staff opened a bag he left unattended and found his wallet, his ID, and a second recorder similar to the first

The release also says that on October 5 he entered the room and appeared to look behind the television.¹ OpenAI says it has “no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data.”²

What the record doesn’t say matters as much. The complaint, now on the docket, doesn’t name the company, as AP reported: it calls OpenAI “Company 1.”⁴³ It doesn’t name the chatbot service either. It does say what linked the two accounts: “installation identifiers, logged IP usage, and user path name references.” But it calls the prompts “attributable to ALFOZAN and/or his spouse” without saying who typed them, and it doesn’t say how investigators got them: a warrant to a provider, a provider’s own review, consent, or a seized device. It doesn’t allege that a foreign government directed anything. The Director of National Intelligence’s quote in the release talks about “foreign threats” in general terms, but the only charge is the interception offense, with a five-year maximum.¹

OpenAI’s statement goes further than the release: “We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier.”² The SF Standard, citing OpenAI, reports that investigators used those models to analyze forensic images of the device’s storage.⁵ That’s OpenAI’s account; neither the release nor the affidavit repeats it. The affidavit credits “Company 1 personnel” with the discovery and the forensic image, which recovered only a MAC address and a custom header (“NANOVOL1”) from the apparently encrypted card.³ Nothing published says OpenAI ran models over anyone’s conversations.

Physical security found it, and the threat model already listed it

According to OpenAI, as reported by the SF Standard, its technical surveillance countermeasures team found the device during a sweep of the conference room.⁵ CCTV, a bag search and a camera OpenAI added to the room after the discovery produced the rest of the evidence the release describes.¹⁴ Whatever OpenAI’s models added to the analysis, finding a bug behind a TV took a physical sweep.

The vector isn’t new to people who study lab security either. RAND’s 2024 report on securing frontier model weights lists “eavesdropping and wiretaps” among its attack vectors, including “planting microphones, cameras, or other automated devices,” and treats insiders with “significant access to sensitive organization resources” as a threat of their own. It recommends insider threat programs and says such measures were “not yet comprehensively implemented in frontier AI organizations.”⁶ Sella Nevo, the report’s lead author, has argued that red teams should test physical intrusion without warning the security team first.⁷

Insider-threat detection systems that have been written up tend to watch digital logs. Google’s Facade, in production there since 2018 and described in an arXiv preprint, is trained on document access, SQL table access and HTTP/RPC request logs.⁸ A system like that could plausibly flag the productivity-tool queries here, but not a USB recorder behind a TV. RAND’s report is about weights; this case, as alleged, targeted conversations. The overlap is the insider with building access.

How prompts reach investigators

Provider policies are consistent on one thing: content and the data that identifies you are separate, and the bar for each is different. OpenAI’s law-enforcement policy requires “a subpoena, court order, search warrant or equivalent” for non-content data and discloses user content only “in response to a valid warrant or equivalent.”⁹ Its transparency report defines non-content as data like name, email address and payment information.¹⁰ On a valid request, it preserves data for up to 90 days and extends that by another 90 on request. It notifies users “unless prohibited by law,” and may withhold notice “in exceptional circumstances.”⁹

From July to December 2025, OpenAI received 75 content requests and disclosed data for 62, plus 224 non-content requests with disclosures for 146.¹⁰ Anthropic’s report for the same half-year lists 2 content requests and 20 non-content requests.¹¹

Linking a spouse’s account to a suspect’s would normally run on the non-content side: emails, phone numbers, payment details, IP addresses, device identifiers. That needs less legal process than the prompts themselves. The complaint’s list fits that side: installation identifiers, IP logs and user path names. How investigators obtained them is unknown. Linkage is also probabilistic. A 2017 USENIX Security study, using data from 126 people, matched their phones to their desktops from IP addresses and browsing history with an F-1 score of 0.91.¹² Even then, some matches were wrong. Shared identifiers tie an account to a household or a device, not automatically to the person typing.

Chat histories are already showing up in criminal cases. A May 2026 Congressional Research Service sidebar lists arson, fraud, child-exploitation and vandalism cases, plus a September 2025 federal warrant for chatbot user data that sought to identify an unknown suspect from ChatGPT exchanges he had described to an undercover investigator.¹³ In the Palisades Fire case, prosecutors cited a ChatGPT question the suspect allegedly typed: “Are you at fault if a fire is lift (sic) because of your cigarettes?”¹⁴

How long the record lasts

Deleting a chat starts a timer; it doesn’t erase anything.

• OpenAI schedules a deleted chat “for permanent deletion from its systems within 30 days,” unless it was already de-identified or OpenAI must keep it longer “for security or legal obligations.” On workspace plans, “authorized compliance tools may still access eligible workspace data.”¹⁵
• Anthropic deletes consumer chats from its back end within 30 days, but keeps chats flagged under its usage policy for up to 2 years and their trust and safety classification scores for up to 7.¹⁶
• Google Gemini auto-deletes activity after 18 months by default. With activity saving off, chats are still kept for 72 hours, and chats sent for human review are kept for up to three years, separate from your account.¹⁷

A preservation request freezes data for 90 days. A litigation hold can freeze it for much longer. In the New York Times copyright case, OpenAI had to preserve chat logs it would otherwise have deleted. An October 2025 stipulated order ended that duty going forward as of September 26, 2025, except for accounts tied to news domains the Times listed, and kept most of what had already been preserved.¹⁸

At work, the record is employer-readable by design. Microsoft stores Copilot prompts and responses in a hidden mailbox folder “that compliance administrators can search with eDiscovery tools.” If the employee’s account is deleted, messages under a retention policy move to an inactive mailbox. Purview retention can also cover prompts to ChatGPT and Gemini when a collection policy is set to capture content.¹⁹ Anthropic’s Compliance API returns chat events with the actor’s email, IP address and user agent attached:²⁰

"actor": {"type": "user_actor", "email_address": "user@example.com", "user_id": "...", "ip_address": "192.0.2.34", "user_agent": "Mozilla/5.0..."}, "type": "claude_chat_created"

That’s the documentation’s example, not real data. Every chat event carries the same kinds of identifiers that link one account to another.

The legal status is unsettled

The CRS sidebar says federal courts apparently haven’t decided whether users have a reasonable expectation of privacy in chatbot histories held by a provider.¹³ A Colorado Lawyer analysis argues the Stored Communications Act likely blocks civil subpoenas to providers for content, while users themselves can be compelled to produce chats they’re able to export.²¹ In United States v. Heppner, a federal judge in New York held that a defendant’s Claude conversations weren’t privileged, leaning on a privacy policy that allowed disclosure to the government (per a law firm’s summary of the opinion; one district court, not binding elsewhere).²² Other courts protected prompts written at a lawyer’s direction as work product.²¹ Sam Altman said in July 2025 that ChatGPT conversations don’t have the legal confidentiality of talking to a therapist or lawyer, and that “we should have the same concept of privacy for your conversations with AI that we do with a therapist.”²³

Consensus: prompts are retained for defined windows, reachable by legal process, and linked to identity by metadata. Investigators already use them.

Active disagreements: whether the Fourth Amendment protects chat histories held by a provider, when privilege or work product applies, and how much weight linked-account evidence should carry.

Open Questions

• Was the spouse-associated account on OpenAI’s own service or a third party’s? If it was OpenAI’s, under what policy did anyone review its content?
• The complaint says installation identifiers, logged IP usage and user path names linked the two accounts. Were those obtained through non-content process before any content was?
• The MAC address and the “NANOVOL1” header came from OpenAI’s forensic image of the card. How were prompts containing them then found? A search across many users’ logs for a hardware identifier would be a reverse search, the kind of thing the CRS sidebar calls a “reverse chatbot warrant” and flags as legally unsettled.¹³
• What exactly did OpenAI’s models do? OpenAI says they helped identify the employee; the SF Standard says they analyzed forensic images of the device’s storage.⁵
• Who wrote the prompts? The affidavit says only “ALFOZAN and/or his spouse,” so it’s at least possible the defendant didn’t.
• Would the prompts still exist if the device had been found a month later, past a 30-day deletion window, without a preservation request?

Next Steps

The complaint is now on the docket. It settles the statute and names the identifiers that linked the accounts, but it doesn’t name the chatbot provider or say how the prompts were obtained. I’ll update this note if later filings do.

The experiment I want to run is smaller: export my data from the three chat services I use, list every identifier that comes back, and compare it with what each privacy policy says it collects.

Angles I might be missing: if you run insider-risk or eDiscovery programs, I’d like to hear whether chat prompts are already in scope for your holds, and how you handle accounts that aren’t in the employee’s name.

Footnotes

1. U.S. Department of Justice, Office of Public Affairs, “Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI,” press release 26-1173, October 13, 2026. https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. OpenAI Newsroom on X, October 13, 2026. https://x.com/OpenAINewsroom/status/2110095403198849132 The same statement is quoted by AP (the AP note below). ↩ ↩² ↩³ ↩⁴

3. Criminal complaint and affidavit of FBI Special Agent Lydia Liang, United States v. Alfozan, No. 3:26-mj-71329 (N.D. Cal. filed October 8, 2026), ECF 1. https://www.courtlistener.com/docket/74958184/united-states-v-alfozan/ ↩ ↩² ↩³

4. Associated Press via WTOP, “Employee arrested after listening device found in OpenAI conference room, FBI and the company say,” October 13, 2026. https://wtop.com/national/2026/10/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say ↩ ↩²

5. SF Standard, “OpenAI engineer arrested in bugging of executive conference room,” October 13, 2026. https://sfstandard.com/2026/10/13/openai-engineer-arrested-alleged-bugging-executive-conference-room/ ↩ ↩² ↩³

6. Nevo et al., Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models, RAND RR-A2849-1, 2024. https://www.rand.org/t/RRA2849-1 ↩

7. 80,000 Hours Podcast #195, “Sella Nevo on securing AI model weights” (official transcript). https://80000hours.org/podcast/episodes/sella-nevo-securing-ai-model-weights ↩

8. Kantchelian et al., “Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection,” arXiv:2412.06700 (preprint). https://arxiv.org/abs/2412.06700 ↩

9. OpenAI, Government User Data Request Policy, v2025.12. https://cdn.openai.com/pdf/openai-law-enforcement-policy-v.2025-12.pdf ↩ ↩²

10. OpenAI, Government Requests for User Data, July–December 2025. https://cdn.openai.com/trust-and-transparency/report-2025h2-government-requests-for-user-data.pdf ↩ ↩²

11. Anthropic, Government Requests Report, July–December 2025. https://www-cdn.anthropic.com/5d453bc3285b8e0c101b7193b5765419920cee24.pdf ↩

12. Zimmeck, Li, Kim, Bellovin and Jebara, “A Privacy Analysis of Cross-device Tracking,” USENIX Security 2017. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/zimmeck ↩

13. Congressional Research Service, “Artificial Intelligence and the Fourth Amendment: Two Emerging Legal Issues,” Legal Sidebar LSB11429, May 5, 2026. https://www.congress.gov/crs_external_products/LSB/PDF/LSB11429/LSB11429.1.pdf ↩ ↩² ↩³

14. NBC News, “Suspect in Palisades Fire pleads not guilty in Los Angeles,” October 23, 2025. https://www.nbcnews.com/news/us-news/suspect-palisades-fire-pleads-not-guilty-los-angeles-rcna239488 ↩

15. OpenAI Help Center, “Deleting and archiving chats in ChatGPT.” https://help.openai.com/en/articles/8809935-how-to-delete-and-archive-chats-in-chatgpt ↩

16. Anthropic Privacy Center, “How long do you store my data?” https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data ↩

17. Google, Gemini Apps Privacy Hub. https://support.google.com/gemini/answer/13594961 ↩

18. In re OpenAI, Inc. Copyright Infringement Litigation, Stipulation and Order, ECF 922, October 9, 2025. https://blogs.duanemorris.com/classactiondefense/wp-content/uploads/sites/56/2025/10/In-re-Open-AI-Inc.-Copyright-Infringement-Litig.-10.9.25-Order-ECF-No.-992.pdf ↩

19. Microsoft Learn, “Learn about retention for Copilot and AI apps.” https://learn.microsoft.com/en-us/purview/retention-policies-copilot ↩

20. Anthropic, Compliance API documentation. https://platform.claude.com/docs/en/manage-claude/compliance-api ↩

21. Estrada, “From Prompt to Production,” Colorado Lawyer, May/June 2026. https://cl.cobar.org/features/from-prompt-to-production/ ↩ ↩²

22. McGuireWoods, “When AI Isn’t Privileged, Confirmed: SDNY’s Written Opinion Elaborates on Confidentiality, Work Product, and Waiver,” February 18, 2026. https://blogs.mcguirewoods.com/2026/02/18/when-ai-isnt-privileged-confirmed-sdnys-written-opinion-elaborates-on-confidentiality-work-product-and-waiver/ ↩

23. TechCrunch, “Sam Altman warns there’s no legal confidentiality when using ChatGPT as a therapist,” July 25, 2025. https://techcrunch.com/2025/07/25/sam-altman-warns-theres-no-legal-confidentiality-when-using-chatgpt-as-a-therapist/ ↩