OpenAI engineering lead Abdulrahman Alfozan, 35, was arrested on October 9, 2026 and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications, according to a US Department of Justice complaint reported by The Hacker News on October 14, 2026.
Alfozan had been employed at OpenAI since July 2025 as an engineering lead. The company has since terminated him.
What the complaint alleges
Around September 30, 2026, OpenAI personnel discovered a surreptitious audio recording device plugged into a USB port on the back of a television in an executive conference room at the company’s San Francisco offices. The device had been concealed inside toilet paper and installed around September 28, 2026.
CCTV footage reviewed by investigators showed Alfozan near the executive conference room on multiple dates before the discovery, despite having no authority to access or take part in meetings there.
The room was reserved for highly confidential technical, commercial and strategic information, including proprietary research, product plans, and nonpublic information about OpenAI’s technical progress and strategic decisions.
The complaint does not allege that Alfozan successfully transmitted any recorded communications to third parties, nor does it specify the total duration of time the device was operational. The charge centers on the act of intercepting oral communications using a concealed device.
The room and its significance
Executive conference rooms at technology companies are typically where product roadmaps, unreleased features, partnership negotiations, and internal assessments of competitive positioning are discussed. The information shared in such rooms is often among a company’s most closely guarded assets, particularly in a competitive field like artificial intelligence where a single leaked detail about a model’s capabilities or a product’s timeline can affect market positioning and strategic partnerships.
Preparation and digital activity
Before the device was installed, Alfozan is alleged to have used an unspecified productivity tool to gather details about OpenAI building addresses, meeting rooms, meeting-room capacities and calendars, leadership and executive locations, and external partner meetings.
A chatbot account associated with him was used for prompts about the device, including its header and unique address, between September 7 and 28, 2026.
What the device was
OpenAI told TechCrunch the device contained advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring. The company said it discovered a sophisticated recording device and used its own AI models to understand the device and where it came from, then referred the matter to the FBI.
A USB-port recording device is a compact piece of hardware that draws power from a USB port and stores or transmits audio. Because it can be concealed inside ordinary objects such as toilet paper rolls, charging bricks, or wall adapters, it is extremely difficult to spot during a casual walkthrough. Unlike a smartphone or a dedicated hidden camera, it typically has no screen, no obvious indicator lights, and can be made to resemble a harmless peripheral. Once in place, it can record continuously and either store audio locally for later retrieval or transmit it over a network connection.
Insider threats are among the hardest security problems for any organization to detect. The person carrying out the activity already has legitimate access to the building, knows the physical layout, and understands which rooms hold the most sensitive conversations. They do not need to break in, pick a lock, or bypass a firewall. They simply walk through a door they are allowed to walk through and place a small device where it is unlikely to be noticed. Standard security tools such as network monitoring and endpoint detection are built primarily to catch external attackers, not employees who are already inside the perimeter and behaving in ways that appear routine.
FBI response
FBI Director Kash Patel said in a statement: “Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology.”
Patel added: “Protecting American SI [super intelligence] innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of its highest counterintelligence priorities.”
What employers can check
The following are general security practices that organizations commonly use to reduce the risk of audio surveillance in sensitive meeting rooms. They are not specific to OpenAI and are recommended across industries where confidential business discussions occur regularly.
- Physical sweeps of meeting rooms on a regular schedule, including checking behind televisions, inside ceiling tiles, behind wall panels, and inside objects placed near conference tables.
- USB port monitoring or blocking on devices in sensitive rooms, using port-locking software or physical USB locks that prevent unauthorized peripherals from being connected.
- Badge access logs and CCTV footage review for rooms where highly confidential discussions take place, with alerts when individuals without a legitimate meeting reservation are detected nearby.
- Device inventory management that tracks which peripherals and accessories are present in each room and flags anything unrecognized.
In addition to technical controls, organizations often implement policies that limit who can bring personal electronic devices into sensitive meeting rooms, require that all meeting room technology be procured and installed by authorized personnel, and conduct regular training sessions so that employees understand the indicators of unauthorized surveillance devices.
These measures, while not foolproof, can make it significantly harder for an insider to place and maintain a recording device in a sensitive space without detection.
OpenAI’s response
OpenAI said in a statement: “At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data.”
The company also fired three safety researchers earlier in October after an investigation found they violated company policies on handling sensitive information.
