Incident
Published 2026-10-13
Updated 2026-10-22
Verified 2026-10-22

OpenAI insider case: DOJ charges engineer Abdulrahman Alfozan with planting a hidden audio recorder in an executive conference room; OpenAI says it used its own models to trace the device and sees no sign of model-weight, code or customer-data theft; 19 Oct: prosecutors' detention memo alleges contact with a Saudi royal and Saudi government support

The US Department of Justice said on 13 October 2026 that Abdulrahman Alfozan, 35, a Saudi national who had worked as an OpenAI engineer since July 2025, was arrested on 9 October and charged with using or trying to use a device to intercept oral communications.

According to the complaint, OpenAI staff found a covert audio recording device on 30 September plugged into a USB port behind a television in an executive conference room in one of its San Francisco buildings. The device was wrapped in toilet paper, had been installed around 28 September and stored encrypted data. The room was used for meetings on proprietary research, product plans, business relationships and government work.

Prosecutors say camera footage showed Alfozan near the room several times though he was not invited to meetings there; that he searched an internal productivity tool for office, meeting-room and executive schedule details; that a chatbot account linked to his spouse asked how to build and hide recording devices, including prompts naming the device's custom header and MAC address; and that on 5 October he returned to check behind the television, the same day security staff found a second similar recorder in a bag he left in another room.

In a statement on X, OpenAI said it used its own AI models 'to understand the device and where it had come from' and referred the matter to the FBI after finding an employee had planted it, and it told TechCrunch it has no indication he accessed or took model weights, source code or customer data (as reported by The Hacker News, which says he has since been terminated). The charge carries up to five years in prison.

UPDATE (19 Oct US time; Reuters via iTnews, 20 Oct): asking a judge to keep Alfozan in custody as a flight risk, federal prosecutors allege in a detention memo that he was in frequent contact with an unnamed member of the Saudi royal family, who had tried to recruit him for an AI role in Saudi Arabia, and that a Saudi military official paid for one-way flights for his wife and young son to return to Saudi Arabia after his arrest. Prosecutors say he built customised, encrypted recording devices to secretly record highly sensitive meetings involving senior OpenAI staff, business counterparts and government officials; meetings with government officials took place in the conference room around the time the device was installed.

Before his arrest he had planned to fly to Riyadh during two months of parental leave. Prosecutors say the investigation remains active and further charges could follow.

His lawyer says the planned trip was booked before any investigation, for family and immigration reasons, and has asked for his release on conditions; the Saudi government media office did not respond to Reuters.

UPDATE (20 Oct; court filing via The Hacker News): a US court granted the government's request to keep Alfozan in detention on Monday 19 October (US time).

The filing says photos on his iPhone dated 22 to 28 September show another concealed recording device and the TV input panels in OpenAI buildings, including a second conference room used for sensitive meetings; parts matching the devices were found at his home; and he opened a folder named "Saudi Gov Docs" on 4 October and used an OpenAI productivity agent to look up Saudi government engagements. His wife and son had already left the US before his planned 12 October one-way flight to Riyadh.

Product
OpenAI offices, San Francisco (insider physical surveillance)
Versions
n/a — incident
Exploited in Australia?
unknown
Patch to
Organisations holding sensitive research: include physical technical surveillance in insider-threat programs. Sweep boardrooms and executive spaces regularly, restrict and monitor USB ports on room displays and AV gear, log badge access to sensitive rooms, and correlate unusual searches of schedules or floor plans with HR and security signals. Practitioner page: /knowledge/insider-threat.

breaches ai