Watch the video, transcript and sources
- OpenAI engineer charged over $24 room bug
+ Anthropic replaces Git with Scion at 30K merges/day
- Cloudflare: Yandex bots migrated with same JA4You think bugging an OpenAI executive conference room takes nation-state spyware. Federal prosecutors say an engineer used a $23.99 microcontroller wrapped in toilet paper. And keep an eye on the unattended bag in the printer room, because what he reported missing the next morning is the wildest detail in the complaint. The Seeed Studio XIAO ESP32-S3 Sense is a thumb-sized hobbyist development board with a digital microphone and a microSD card slot that sells on Amazon for $23.99. According to a Department of Justice complaint unsealed Tuesday, one turned up inside OpenAI's San Francisco headquarters.
Today's diff has three stories. An OpenAI product engineer faces federal wiretap charges in San Francisco. Anthropic replaces Git after Claude pushes merges past 30,000 a day. And Cloudflare checks whether drone strikes on Yandex stopped Russian botnets. On September 30, OpenAI's surveillance team swept an executive conference room where leadership held confidential meetings. Plugged into a USB port on the back of the television was Recording Device 1, folded inside a triangle of toilet paper. Prosecutors allege the device was planted around September 28 by 35-year-old engineer Abdulrahman Alfozan, who joined OpenAI's product team last July after five years at Meta. Before the board went in, he allegedly queried an internal tool for building addresses and executive meeting locations.
Then comes the operational security masterclass. Between September 24 and 30, a chatbot account tied to his spouse and sharing his identifiers asked how to build a continuous audio recorder and encrypt the SD card. It even pasted the board's unique MAC address. OpenAI says investigators used its own AI models to analyze forensic images of the device's storage and trace where it came from. On October 5, a motion camera behind that television caught Alfozan peeking behind the screen. OpenAI says it found no indication that model weights or source code were taken. Alfozan was arrested October 9 under the federal wiretap statute (18 U.S.C. § 2511), facing up to five years in prison. His defense attorney says the allegations are wholly out of character, and an accusation is not guilt.
Across town at Anthropic, the problem was Claude writing too much code for Git to survive. In May, Anthropic merged around 2,500 changes a day. By September, that passed 30,000 merges a day. Their main branch history is nearly 100 GB, and continuous integration runs 25 million checkouts a day. Fetched naively, that would be 600 petabytes of daily Git traffic, pushing hundreds of internal Git mirrors past their disk limits. So seven engineers built Scion, an in-house centralized version control system, and migrated the monorepo in five months. Because coding agents stay online, Scion keeps history on Spanner and cloud storage, streaming blobs through regional memory caches with a 99% hit rate.
Anthropic says an internal snapshot of Claude Mythos Preview rewrote their Git ingestion prototype to use 20× less memory and run 4× faster. They even created Slack channels where Claude instances called "superfans" obsessively refresh telemetry charts for a single daemon. There is just one awkward detail. Anthropic's blog post explained how Scion stores minimal changesets and recursively computes blame indices through a mechanism they call "derived data." They thanked Google's Piper and Meta's Sapling for general lessons, while never mentioning Meta's Mononoke server. Yesterday, Rain, who helped build Meta's open-source Mononoke server in 2017, posted Anthropic's paragraph beside their 2022 Mononoke write-up. Both use the exact term "derived data" and the same recursive parent-changeset index for fast blame. Mononoke is open source on GitHub, right inside Claude's training set.
When Rain asked Claude Opus 5.5 and GPT-6 Astra what prior art Scion resembles, both models immediately named Mononoke. Even the model knows whose homework it copied. Meanwhile, Cloudflare published the postmortem on the October Yandex outage. Between October 7 and 11, reported drone strikes hit three Yandex data-center facilities, knocking Yandex Search traffic down 99% and Yandex.Cloud down 90%. Commentators celebrated that Russian bot farms had finally gone dark because automated traffic from Russia dropped 8%. Cloudflare checked the autonomous system numbers and found the drop on Yandex Search was 93.6% verified search crawlers indexing news sites.
The unverified bots on Yandex.Cloud simply packed their bags. On one targeted gambling customer, Yandex.Cloud bot traffic dropped to zero on October 8 and immediately reappeared from rival Russian hosts Selectel and Radist with the exact same JA4 TLS fingerprint. Total bot requests rose 1.4%. Which brings us back to that unattended bag in OpenAI's printer room on October 5. Security opened it and found Alfozan's wallet alongside a second customized recording device, which they confiscated. When he picked up the bag the next day, he reported $500 cash and his AirPods stolen, while never mentioning the missing spy bug.
Verdict: REVERT — Don't paste your spy bug's MAC address into a chatbot — and credit Mononoke
Sources
https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai
https://sfstandard.com/2026/10/13/openai-engineer-arrested-alleged-bugging-executive-conference-room/
https://sfstandard.com/2026/10/14/abdulrahman-alfozan-who-openai-engineer-accused-hiding-recording-device/
https://x.com/OpenAINewsroom/status/2110095403198849132
https://www.anthropic.com/engineering/redesigning-source-control
https://sunshowers.io/posts/anthropic-mononoke/
https://github.com/facebook/sapling/tree/main/eden/mononoke
https://blog.cloudflare.com/yandex-outage/
https://radar.cloudflare.com/traffic/ru
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.