OpenAI engineer charged with planting listening device in executive conference room

Federal prosecutors accuse Abdulrahman Alfozan of installing a covert recorder in a TV at the AI firm's San Francisco office.

Threat Times Systems DeskOctober 14, 20262 min read

Share LinkedIn Reddit

Illustration: A small black bug hides behind the frame of a flat-screen television mounted on a white wall in a modern conference room. — AI-generated illustration: Threat Times

Key points

Abdulrahman Alfozan, 35, was arrested on 9 October and charged with attempting to intercept oral communications.
Investigators found a Seeed XIAO ESP32-S3 Sense device wrapped in toilet paper behind a television in an executive room.
OpenAI stated that no model weights, source code, or customer data were compromised during the incident.

The Department of Justice charged OpenAI engineer Abdulrahman Alfozan on 13 October after federal agents arrested him on 9 October. Prosecutors allege he installed a covert recording device in an executive conference room at the company’s San Francisco headquarters, seeking to intercept private oral communications.

Alfozan, a 35-year-old Saudi national and permanent US resident, faces up to five years in prison and a $250,000 fine. Court documents describe the device as a Seeed XIAO ESP32-S3 Sense unit plugged into a USB port behind a television. Staff discovered the bug, wrapped in toilet paper, on 30 September, two days after it was allegedly installed.

Investigation details and technical findings

Prosecutors say Alfozan lacked authority to enter the executive conference room, yet closed-circuit footage places him near the area on multiple dates. The room is often used for high-level technical discussions and meetings with government representatives. A second recording device was found on 5 October inside an unattended bag belonging to the accused.

OpenAI used its own AI models to analyze the hardware. The complaint states the device may have been modified to prevent data transfer between the recorder and the television. The microSD card’s contents may also have been encrypted, as the company could not retrieve stored data after creating a forensic image.

No data breach confirmed

OpenAI confirmed that no model weights, source code, or customer data were taken during the incident. The company stated there is no indication that any proprietary information was exfiltrated. This distinction is significant for regulatory reporting requirements, particularly under the EU code of practice, which mandates breach notifications for serious incidents involving marketed models.

Officials did not allege that any foreign government directed Alfozan’s actions. The Justice Department spoke broadly about protecting American technology from foreign threats but did not name a state sponsor. Alfozan appeared in federal court on 13 October following his arrest.

What should you do?

Organizations should review access logs for executive meeting rooms and verify that only authorized personnel can enter. Security teams should inspect USB ports on conference room displays for unauthorized hardware. Companies should also audit AI model usage to ensure internal tools are not being used to bypass security controls. Finally, organizations should ensure that all recording devices are inventoried and encrypted storage is monitored.

What to do and how to stay safe: OpenAI

Audit physical access logs for sensitive executive meeting rooms to identify unauthorized entries.
Inspect USB ports on conference room displays and peripheral devices for unauthorized hardware implants.
Monitor AI model usage patterns to detect attempts to analyze or bypass internal security controls.
Verify that all recording and storage devices in shared spaces are inventoried and properly secured.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.