A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices to secretly record sensitive conversations.
The U.S. Department of Justice announced Tuesday that Abdulrahman Alfozan, 35, who had worked at OpenAI since July 2025, was arrested on October 9 and charged with illegally intercepting oral communications.
The DOJ says OpenAI security personnel discovered the recording device on September 30, plugged into a USB port behind a television in an executive conference room.
According to the DOJ, OpenAI determined that the device had been concealed in toilet paper, was installed around September 28, and contained encrypted data.
“On or about Sept. 30, OpenAI personnel discovered a surreptitious audio recording device (Recording Device 1) inserted into a USB port on the back of a television in an executive conference room inside one of their buildings in San Francisco,” says the DOJ press release.
The DOJ says the conference room was regularly used for meetings involving confidential information about OpenAI’s proprietary research, product plans, technical capabilities, business relationships, and government engagements.
Security camera footage allegedly showed Alfozan near the conference room on multiple occasions, despite not being authorized to attend meetings held there.
According to the complaint, Alfozan also used a productivity tool to search for information about OpenAI’s offices, meeting rooms, executive locations, and meeting schedules.
The complaint also says a chatbot account associated with Alfozan’s spouse was used to ask questions about building and concealing recording devices.
These included inquiries about creating a continuous audio recorder, modifying Wi-Fi connectivity, improving live listening capabilities, and encrypting an SD card.
“The same chatbot account also submitted prompts specifically related to Recording Device 1, including its custom header and unique MAC address, between Sept. 27 and Sept. 28,” alleges the DOJ.
On October 5, surveillance footage allegedly captured Alfozan returning to the conference room and looking behind the television where the device had been installed.
The complaint says that on that same day, OpenAI security employees discovered a second, similar recording device inside a bag Alfozan had left unattended in another room.
In a statement posted on X, OpenAI said it used its own AI models to investigate the suspicious device and help identify the employee responsible.
“We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier,” OpenAI said.
The company said it terminated the employee and referred the incident to the FBI.
“At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data,” OpenAI added.
If convicted, Alfozan faces up to five years in prison and a $250,000 fine.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits
OpenAI will show visual ads in ChatGPT while you generate images
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email
OpenAI’s AI agents accidentally uploaded user-provided images to third-party sites
Ledger confirms spy chip implant behind wallet crypto thefts
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Cyberattack shuts down refrigerators at French supermarkets
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
Is your backup really out of reach? See what the latest attacks reveal.
Overdue a password health-check? Audit your Active Directory for free
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
AI is a data-breach time bomb: Read the new report
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
