Detecting a Covert Recording Device with Nzyme

Note that we will speculate on the nature of the covert recording device, but we can make some pretty strong assumptions based on the photos in the court documents.

I would also like to note that we are not in the business of scaring people about unrealistic threats. Consider whether planting such a device should be in your threat model. Nonetheless, it is an interesting tabletop scenario to run for any company or potentially targeted individual.

We strongly believe that Nzyme would have detected this specific device very early, and we want to share how such a monitoring system can be set up.

The Device

The United States Attorney’s Office for the Northern District of California issued a press release that contains a photo of the recovered device:

The press release states:

An employee of OpenAI, a super intelligence (SI), also known as artificial intelligence, company headquartered in San Francisco, has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications.

[…]

Moreover, a chatbot account associated with Alfozan’s spouse (which shared multiple identifiers and attributes with Alfozan’s own chatbot account) submitted prompts between September 24, 2026, and September 30, 2026, related to building, customizing, installing, audio recording, testing, obfuscating, and remote accessing a device, including inquiries about “build[ing] a continuous audio recorder,” “customiz[ing] Wi-Fi . . . connectivity,” “improv[ing] audio and live listening,” and “encrypt[ing] the SD card,” among other things. The same chatbot account also submitted prompts specifically related to Recording Device 1, including its custom header and unique MAC address, between September 27, 2026, and September 28, 2026.

[…]

Finally, the complaint alleges that, also on or about October 5, 2026, Alfozan left a bag unattended in a different room in an OpenAI building. OpenAI security personnel found and opened Alfozan’s bag, inside which they discovered—among other things, including Alfozan’s wallet and ID—another recording device similar to Recording Device 1.

By combining the press release photos with this information, we can assume that the planted device was a microphone combined with a 2.4 GHz WiFi radio. It may also have had a local SD card to store recorded audio on.

The 2.4 GHz spectrum contains the common WiFi frequencies and provides a communication range just like the one you are used to from your home or office WiFi. It is unlikely to provide very long-distance communication, especially inside an office building.

Common WiFi chipsets like the ESP32 contain everything a device needs to process recorded audio and establish a WiFi connection. Such a chip is the size of a fingernail or smaller and is readily available for a few dollars or less.

We did a little bit of research and found a device that appears to match the photos: Seeed Studio XIAO ESP32-S3 Sense.

This device has WiFi and Bluetooth Low Energy connectivity built in and is advertised at a price of $13.99. The store website says that it ships from California.

The on-board sensors include a camera and a microphone. It also has an SD card slot. The microphone can write directly to the SD card.

With a size of 21 x 17.8 mm, it can be hidden easily and run off a battery for a long time.

Detection in Nzyme

Ways to detect such a covert device depend on how it is exfiltrating its recorded data. In this case, we can assume a few possible ways of doing so:

1. As a Bluetooth device the attacker connects to directly
2. As a WiFi access point the attacker connects to
3. As a WiFi client that is connected to an existing WiFi network or one spun up by the attacker
4. By physically recovering the SD card and not using WiFi or Bluetooth at all

Detecting a Rogue Bluetooth Device

Detecting 1) (the covert device communicating via Bluetooth) is possible in Nzyme by reviewing the list of detected Bluetooth devices in range and running Monitors that alert on ESP32-based devices. Note that the MAC address of the device could have changed, so regular manual reviews of Bluetooth devices are always a good practice.

Detecting a Rogue WiFi Access Point

If the device spun up its own access point, it would have appeared in the list of recorded networks. Any new network is presented for review by an analyst. The rogue network would have been alerted on almost immediately after the device powered on. SSID monitoring is described in the Nzyme documentation.

On top of that, the network would have been listed in the overview of active networks, with signal strength and, possibly, an ESP32-based device fingerprint and manufacturer name.

Detecting a Rogue WiFi Client

If the device did not spin up its own access point but rather connected to an access point as a client, it would have connected either to a new access point under the attacker’s control or to a known-good access point like the legitimate corporate WiFi.

If it connected to an access point controlled by the attacker, Nzyme would likely have flagged that access point as described above.

If it connected to the existing corporate WiFi, Nzyme would likely have detected and flagged it as a new and previously unseen device in either its WiFi or Ethernet subsystem.

In both cases, it would likely also have shown up as a new WiFi Client in Nzyme.

Physical Detection

We can rule out detection of 4) by Nzyme because the device would be radio-silent. This sort of detection needs physical counter-surveillance sweeps. However, this is also the riskiest method of exfiltration, because the attacker needs to return, likely multiple times.

Again, we believe that Nzyme would likely have caught this attack very early. As always in security, there are layers, and no single solution can provide guaranteed safety. If you believe that you could be a target of such a covert listening device attack, we encourage you to consider Nzyme as a part of your layered defense against it.