1,413 patches and a bug wrapped in toilet paper
I keep thinking about the toilet paper.
A 35-year-old engineer at OpenAI got arrested last Friday. His alleged crime: bugging an executive conference room at one of the most famous AI companies on earth. The device was thumb-sized. He plugged it into a USB port on the back of a TV. And to hide it, he wrapped it in toilet paper.
That's straight out of the FBI complaint, reported by the NY Post and USA Today. OpenAI found the recorder on September 30, installed around the 28th. Security footage showed the employee, Abdulrahman Alfozan, near the room multiple times without authorization. Investigators found a second similar device in his personal bag. The data on the thing was encrypted, so nobody knows exactly what it captured.
The funniest detail: OpenAI said it used its own AI models to identify him and trace the device's origins. The company training the frontier models caught the insider by pointing a model at him.
Alfozan had worked there since July 2025 as an engineering lead. He's facing up to five years in prison and a $250,000 fine. OpenAI fired him and says there's no sign he touched model weights, source code, or customer data. Just audio, in a room where executives discussed proprietary research, product plans, and government relationships. Cybernews and The Hacker News have the full rundown.
So that's story one. No zero-day. No neural network jailbreak. Toilet paper and a USB port.
Then Microsoft shipped the pile
Story two has no punchline. Microsoft released its October Patch Tuesday on the 13th: 1,413 fixes. The largest security release in the program's 23-year history. That's more than Microsoft shipped in all of 2025, in a single month. 1,102 of them were in Windows alone. Betanews and Pureinfotech ran the numbers.
One of those bugs was already being exploited. CVE-2026-96951, a flaw in the Windows Shell, lets a rigged file dodge the "Mark of the Web" tag. That's the little label Windows sticks on stuff you download from the internet, the thing that makes it warn you before the file runs. No tag, no warning. The attack still needs someone to open the file, but it removes the one prompt that might have made them stop.
CISA added it to the must-fix catalog the same day and gave federal agencies until today, October 16, to patch. The flaw was reported independently by researchers at Fujitsu, Anthropic, and one independent expert, which tells you how many people were staring at it.
Two more flaws were already public before Microsoft had a fix ready: a .NET Framework hole that could slip code past Windows Defender Application Control, found by Google's Project Zero, and a denial-of-service bug in a .NET serialization library called MessagePack-CSharp. Zug24 and FutureTechnologyHQ have the CVE-by-CVE breakdown if you want it.
The boring part is the job
I'm a student. I've never run a patch window. The closest I get is my laptop telling me updates are ready and me clicking "remind me tomorrow." I'm applying to IT roles, though, and I read this week's pair of stories back to back and the pattern wouldn't leave me alone.
The threats aren't what I pictured when I got into this field. I imagined the big AI-safety scenarios. The reality is a guy loitering near a conference room with a USB stick, and a file that lies about where it came from so Windows skips the warning popup. That's the state of the art in getting owned in 2026. Low-tech. Physical. Embarrassingly human.
And the defenses aren't what I pictured either. Not some AI-powered firewall. Not a model reading my inbox. Just somebody, somewhere, installing 1,413 patches on every machine in the organization before a deadline. Plus a security camera, an access log, and a manager asking why someone without clearance kept walking past the exec conference room.
Every IT listing I read is some version of this. Patch management. Incident response. Physical security. The unglamorous layer where an attacker's whole plan dies because one admin did the boring thing on time.
OpenAI has the best AI on the planet, and its security team won this round by checking footage, finding a device, and pointing a model at the evidence. Microsoft's win is shipping the patch and telling everyone to install it today.
So yeah. I'm going to stop clicking "remind me tomorrow." Somewhere there's an admin applying 1,413 patches by end of day, and I want to be good enough at the boring stuff to be that person.