OpenAI engineer arrested over hidden office recording device

An OpenAI engineer was arrested after the company found a hidden audio recorder in an executive conference room at its San Francisco offices and traced it to him. Abdulrahman Alfozan, 35, a Saudi national who had worked at OpenAI since July 2025, is charged with illegally intercepting oral communications and faces up to five years in prison and a $250,000 fine. The account here is drawn from the federal criminal complaint as reported by BleepingComputer and SecurityWeek; the DOJ had not published a press release at the time of writing.

What happened

Per the complaint, filed in federal court in San Francisco:

• A recording device was concealed in toilet paper and plugged into a USB port behind a television in a conference room used for meetings on proprietary research, product plans, and government engagements. Prosecutors say it was installed around September 28.
• OpenAI security personnel found it on September 30. On October 5, surveillance footage allegedly showed Alfozan returning to the room and reaching behind the TV; security that day found a second similar device in a bag he had left unattended in another room.
• The device held encrypted data. Alfozan, who was not authorized to attend meetings in that room, allegedly used an internal productivity tool to look up office locations, meeting rooms, executive locations, and schedules.
• A chatbot account linked to his spouse allegedly asked how to build and conceal recording devices and encrypt an SD card, with prompts referencing the device's MAC address submitted between September 27 and 28.

These are allegations from the complaint, not proven facts. Alfozan was arrested on October 9 and made his first court appearance on October 13.

OpenAI's account

OpenAI said in a public statement that it used its own models to examine the device and trace its origin, which identified a specific employee who had planted it "a few days earlier." The company terminated the employee and referred the case to the FBI. Critically for anyone modeling the blast radius, OpenAI said it has "no indications of this individual inappropriately accessing or exfiltrating model weights," and no indication of inappropriate access to source code or customer data.

Action checklist

This is a physical-insider case, not a software bug — but the controls that catch it are ones every security team owns:

1. Sweep sensitive meeting spaces. Rooms used for M&A, legal, or research discussions warrant periodic physical inspection and, where justified, technical surveillance counter-measures. The device here was found by routine security, not luck.
2. Scope internal-tool access to role. Alfozan allegedly used a legitimate productivity tool to map executive schedules and room assignments. Audit who can query org-wide location and calendar data, and alert on anomalous bulk lookups.
3. Review badge and camera coverage for rooms where the most sensitive conversations happen, and reconcile physical access logs against meeting attendance.
4. Have a referral path ready. OpenAI preserved the device, traced it, and handed the FBI a case — don't improvise evidence handling after the fact.

Context

Insider threats against frontier-AI labs keep showing up in different forms. Earlier this month a core infrastructure engineer was sentenced to 32 months for locking his own employer out of its systems, and OpenAI itself recently said it disrupted a model-distillation campaign aimed at extracting its models' reasoning. The through-line is that the crown jewels — model weights, research direction, roadmaps — attract adversaries willing to go beyond a phishing email, and the countermeasures stretch from identity governance to a tech sweep of the boardroom.