Prosecutors: OpenAI Spy Suspect Booked One-Way Ticket to Saudi Arabia Before Arrest

Federal prosecutors disclosed that Abdulrahman Alfozan, a former OpenAI engineer, booked a one-way flight to Saudi Arabia before his arrest on charges of intercepting oral communications. The U.S. Attorney’s Office in San Francisco sought to keep court records sealed, arguing that public disclosure could allow the suspect to flee the country before law enforcement could detain him.

According to Bloomberg, prosecutors told a judge on October 8 that Alfozan, his wife, and a third family member had purchased one-way tickets from San Francisco to Saudi Arabia via Istanbul for October 12, 2026. The filing stated that the defendant had both the means and the incentive to leave the United States sooner if he became aware of the investigation prior to his arrest. The judge granted the request to seal the case details.

Evidence and Investigation Timeline

OpenAI notified the FBI after employees discovered a hidden recording device plugged into a USB port on a television in a conference room on or around September 30, 2026. As Threat Times reported on October 14, 2026, federal authorities arrested Alfozan on October 9. A Justice Department announcement detailed evidence linking him to the device, including CCTV footage placing him near the room.

Prosecutors also cited logs from a “productivity tool” Alfozan used to pull data on OpenAI meeting rooms and their calendars. Additionally, logs from a “chatbot account” linked to Alfozan’s wife showed queries related to audio recording and encrypting SD card contents. At one point, Alfozan left a bag containing a similar recording device, his wallet, and his ID unattended in the office. OpenAI security staff subsequently discovered the bag and its contents.

Ties to Saudi Venture Capital

Alfozan serves as a venture partner at Raed Ventures, a Saudi Arabian venture capital firm. The firm also lists Prince Khalid bin Bader Al Saud, a member of the Saudi royal family, as a venture partner. Prosecutors have not accused Raed Ventures of knowing about the bugging incident. However, a former CIA officer who spoke with CNBC characterized Raed as “basically a state organ.”

The former officer noted that if the bugging is state-sponsored, it suggests Saudi Arabia views the AI boom as significant enough to warrant economic espionage against a close ally. They described the incident as “probably the tip of the iceberg,” implying broader risks for the tech sector. That suggests heightened scrutiny may be needed for foreign-linked investors in sensitive technology hubs.

What should you do?

Organizations should monitor for unusual access patterns to meeting room schedules and internal productivity tools. Security teams should regularly audit physical spaces for unauthorized devices, particularly in high-value conference rooms. Employees should report any unattended bags or suspicious items immediately to internal security. Companies should review access logs for accounts linked to external family members or unrelated third parties.

What to do and how to stay safe: OpenAI

• Audit physical security in executive meeting rooms for unauthorized recording devices.
• Monitor access logs for productivity tools used to query sensitive calendar data.
• Implement strict policies for unattended personal items in secure areas.
• Review chatbot and AI tool usage logs for queries related to surveillance or encryption.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When was the recording device discovered at OpenAI?

OpenAI notified the FBI after employees found the device on or around September 30, 2026.

Did prosecutors accuse Raed Ventures of espionage?

No, prosecutors have not accused Raed Ventures of knowing about the bugging incident.

What evidence linked Alfozan to the recording device?

Evidence includes CCTV footage, productivity tool logs, and a bag with a similar device left unattended.