My family hid six cameras inside my apartment because they wanted my $37.5 million AI algorithm.

They thought the cameras gave them control.

They thought watching me long enough would eventually reveal a password, a server address, or one careless moment that would turn years of my work into something they could copy in an evening.

What they never considered was that I might find the cameras and decide not to remove them.

The first lens was behind the smoke detector in the hallway.

It was not large enough to notice at a glance, but the housing sat slightly crooked, and a pinprick of reflected light flashed when the blinds shifted in the afternoon breeze.

I stood beneath it with a paper coffee cup in my hand and listened to the ordinary sounds of my apartment.

The refrigerator hummed.

A car door slammed in the parking lot.

The air vent clicked as the system shut off.

Nothing about the room looked dangerous, yet somebody in my own family had turned it into a surveillance box.

I did not touch the camera.

I walked through the apartment as if nothing had happened.

The second device was hidden inside a charger block beside my bed.

The third watched my desk from the bookshelf.

The fourth had a clean view of the kitchen table.

The fifth sat behind the vent cover.

The sixth was wedged above the living-room curtain rod, angled so it could see both the couch and the laptop screen whenever I worked there.

Six lenses.

Six stolen views.

I knew immediately what they wanted.

The algorithm was not a hobby project or a half-finished idea.

It was the result of years of work, failed tests, rebuilt models, long nights, and the kind of discipline that looks boring from the outside until somebody attaches a dollar amount to it.

A private valuation had put that amount at $37.5 million.

After that number existed, the questions from my family changed.

They stopped asking whether the project was going well.

They started asking where I stored it.

They wanted to know whether I used a cloud provider, whether the code could fit on one drive, whether a person needed special permission to run it, and whether the valuation meant I could sell it immediately.

Each question sounded casual by itself.

Together, they formed a map.

I had answered almost nothing.

I kept development machines separate from testing machines.

I did not reuse credentials.

I did not leave production access written on paper.

I did not discuss repository locations over the phone.

That should have ended the matter.

Instead, somebody came into my apartment and installed six cameras.

For one hard minute, I wanted to pull every device from the wall.

I imagined dropping them into a grocery bag, carrying them to the next family gathering, and emptying them across the table.

I could already hear the denials.

Nobody was trying to steal anything.

The cameras were for safety.

There had been a misunderstanding.

I was being paranoid.

Anger makes immediate action feel honest, but immediate action is not always useful.

So I left every camera exactly where it was.

Then I checked the rest of my systems.

The real algorithm was not reachable from the apartment network.

The production environment was isolated behind controls they had never seen.

The source repository required access they did not possess.

The model assets were separated from the machine I used in the living room.

Nothing visible to those cameras could lead them to the real system unless I deliberately created a path.

That was what I decided to do.

I built an isolated audit server.

It looked convincing enough to someone who already believed they had won.

The directory structure resembled a working environment.

The file names were plausible.

The access path looked valuable.

But the server could not touch my production system, my real source code, or the protected model assets.

Its purpose was not to serve the algorithm.

Its purpose was to record behavior.

Every login attempt would receive a timestamp.

Every device would generate a fingerprint.

Every copied command would be stored.

Every opened directory, pasted credential, transfer request, and destination address would be preserved.

The server was a room with one unlocked door and cameras pointing inward.

The next morning, I sat at my desk in full view of the bookshelf lens.

I placed a yellow legal pad beside the keyboard.

I wrote the server address slowly, one character at a time.

I paused twice as though I were trying to remember it.

Then I underlined the address and left the page angled toward the camera.

I added a closed notebook and a paper coffee cup to make the scene feel ordinary.

Carelessness has a visual language.

I gave them exactly what they expected it to look like.

After that, I went through the rest of the day without acknowledging the cameras.

I made lunch.

I answered messages.

I carried a grocery bag in from the parking lot.

I sat on the couch with my laptop and worked on something unrelated.

The six lenses kept watching.

By evening, the legal pad was still beside the desk.

At 8:14 p.m., the first connection reached the audit server.

The notification appeared in the corner of my real laptop while I sat on the couch.

One new session.

The server recorded the device type, network path, login sequence, and exact second of entry.

At 8:15, a second laptop connected.

Nine seconds later, a third device authenticated.

Then the fourth appeared.

Four laptops.

Four distinct device signatures.

Four people moving so closely together that the connection times looked coordinated.

They had not found the address by accident.

They had shared it.

They had planned the login.

They had expected to divide the work.

On the audit dashboard, four cursors began moving through the decoy environment.

One user tried the same password three times before getting in.

Another opened the system map.

A third searched for folders marked as core assets.

The fourth spent nearly a minute watching before joining the others.

I could see the logic of the group through their keystrokes.

One person gave direction.

One person searched.

One prepared the transfer.

One hesitated, then participated.

That hesitation mattered.

People often imagine betrayal as a dramatic decision.

Sometimes it is simply the moment a person knows something is wrong and continues anyway.

The server recorded that moment too.

A transfer request opened.

The upload bar appeared.

Twelve percent.

Twenty-eight percent.

Forty-six percent.

The files they were taking were part of the isolated environment.

They looked valuable from the outside, but they could not expose the real algorithm.

Their value was evidentiary.

Every attempt to take them proved intent.

Every command made the record clearer.

I opened a separate window showing the six hidden camera feeds.

The hallway.

The kitchen table.

The desk.

The couch.

The bed.

The living-room window.

My own apartment appeared in six small boxes, watched from angles I had never agreed to share.

For days, those cameras had represented their advantage.

Now they were simply another part of the chain.

At 61%, the audit server reported four active identities, four synchronized sessions, and one shared destination.

At 74%, the device fingerprints finished resolving.

At 83%, the system sealed the first evidence bundle.

At 92%, one of the users opened the file labeled as the core algorithm package.

The cursor paused over it.

Then the transfer continued.

I kept my hands still.

There was no need to interrupt.

The safest moment to close a trap is after everyone has stepped inside it.

The progress bar reached 97%.

Then 99%.

All four cursors stopped moving.

For one second, the dashboard was completely still.

The upload reached 100%.

Every hidden camera feed flickered at the same time.

The apartment views disappeared.

A white system window replaced each one.

The first line appeared across all six feeds.

FOUR IDENTITIES VERIFIED.

The second line followed.

EVIDENCE PACKAGE CREATED.

For three seconds, none of the four laptops disconnected.

That silence was the first honest reaction I had seen from them.

They understood at once that the server address had not been a gift.

It had been a test.

They understood the cameras had not made me helpless.

They had connected the surveillance, the access attempt, the copied commands, and the transfer to four verified sessions.

Then panic started.

The first laptop tried to erase its session history.

The server recorded the deletion command and preserved the original log.

The second user attempted to rename the destination folder.

The server recorded both names.

The third disconnected.

The exact second of the disconnect entered the manifest.

The fourth remained online, frozen.

A new verification summary opened on my screen.

It matched each device signature to its login sequence.

It preserved the copied server address.

It showed which session initiated the transfer.

It listed the destination selected for the files.

It connected the camera-access timing to the same chain of activity.

They had believed the hidden lenses would make them invisible.

Instead, the lenses helped establish how they obtained the information.

The person who had been giving directions stopped typing.

A hand dropped from the keyboard.

Another chair scraped backward.

Someone attempted to close a laptop, then opened it again as if the message might disappear.

It did not.

The server continued sealing the package.

The final manifest contained the timestamps, device fingerprints, command history, transfer records, destination data, and camera-access sequence.

Nothing in that package depended on my interpretation.

It was not a family argument.

It was not my word against theirs.

It was a process record created by the actions they had chosen to take.

That distinction mattered more than any speech I could have given.

I did not call them.

I did not send a furious message.

I did not reveal where the real algorithm was stored.

I let the audit server finish.

When the evidence package completed, the four active sessions were terminated.

The decoy environment locked.

The server address stopped accepting new connections.

The six hidden camera feeds went dark.

For the first time since I had found the lens above the hallway, my apartment felt like mine again.

The real algorithm had never been on that server.

It had never been within reach of the cameras.

It had never traveled to the destination they selected.

They had uploaded nothing worth $37.5 million.

What they had created instead was a complete record of themselves trying to take it.

That was the part they had never imagined.

They had treated family access as permission.

They had treated familiarity as invisibility.

They had assumed that because they knew my habits, they knew my limits.

But knowing where someone drinks coffee is not the same as knowing how they think.

Knowing where someone keeps a laptop is not the same as owning what is on it.

And being family does not turn theft into concern.

The next morning, the yellow legal pad was still on my desk.

The underlined server address sat in the same place.

The paper coffee cup had gone cold beside it.

Nothing in the apartment looked different until I began removing the cameras.

I took down the hallway device first.

Then the charger block.

Then the bookshelf camera.

Then the one facing the kitchen table.

Then the vent camera.

Then the lens above the curtain rod.

I placed all six on the table in a straight line.

They looked smaller once they were no longer hidden.

That was true of the plan too.

From inside it, their scheme had probably felt clever.

From outside it, it was only four people following a baited address into an isolated server and documenting every step for me.

I saved the audit package in more than one protected location.

I preserved the original logs.

I kept the camera hardware separate.

I changed the apartment access that had allowed the devices to be planted.

Most importantly, I left the real algorithm exactly where it had been all along: beyond their reach.

The $37.5 million valuation had made them believe the most valuable thing in my apartment was code.

They were wrong.

The most valuable thing was control.

They lost theirs the moment four laptops connected at once.

I kept mine by letting them believe they still had it.

When the upload reached 100%, they thought the theft was complete.

In reality, that was the exact second the evidence became complete.

All six feeds had shown them the same message.

Four identities verified.

Evidence package created.

And for the first time, every person involved knew the truth.

They had not stolen my algorithm.

They had signed their names to the attempt.