Key points
- FBI arrested Abdulrahman Alfozan after OpenAI detected a sophisticated recording device in its San Francisco headquarters.
- The company used its own AI models to analyze the hardware and trace its origin to a specific employee.
- Prosecutors allege the device was placed in a room used for confidential discussions on product roadmaps and government engagement.
The short version
- OpenAI found a DIY recording device hidden in an executive conference room at its San Francisco office.
- The company used its AI models to identify the device and determine that an employee had planted it.
- The FBI arrested the employee, Abdulrahman Alfozan, who faces federal charges for unauthorized recording attempts.
The details
OpenAI discovered a sophisticated recording device hidden inside one of its offices on September 30, 2026. The device was plugged into a USB port on the back of a television and concealed with toilet paper, according to prosecutors. The company used its own AI models to understand the device and trace its origin, identifying that a specific employee had planted it a few days earlier. OpenAI referred the matter to the FBI, resulting in the arrest of Abdulrahman Alfozan, a 35-year-old engineer who had joined the company in July 2025.
Prosecutors state that Alfozan left the device in an executive conference room he was not authorized to enter or use. Meetings in this room often involved confidential information, including details related to the company's product roadmap, research, and government engagement. The complaint indicates that Alfozan used a "productivity tool" to collect information about OpenAI's facilities. He may also have used a chatbot to ask how to build, install, and hide a remote recording device.
View the original post on X
Investigators found prompts on a chatbot account tied to Alfozan's spouse asking the AI model how to "build a continuous audio recorder" and "encrypt the SD card." On October 5, 2026, Alfozan allegedly left a bag in another part of the office. Security personnel found his wallet, identification, and a second recording device inside the bag. OpenAI determined the first device was installed around September 28.
The context
In a statement published on X, OpenAI confirmed it used its models to understand the device and identify the person who placed it. The company stated it has no indications that the individual inappropriately accessed or exfiltrated model weights, source code, or customer data. Alfozan was terminated from his position. He made his first court appearance on Tuesday, October 13, 2026.
If convicted, Alfozan faces up to five years in federal prison, a $250,000 fine, and three years of supervised release, according to the San Francisco Standard. OpenAI did not immediately respond to requests for further comment from Engadget. The incident highlights the use of internal AI tools for security investigations and the potential for insider threats involving physical surveillance devices.
What to watch
- Monitor for any updates on whether Alfozan successfully exfiltrated data despite OpenAI's initial assessment.
- Watch for changes in OpenAI's internal security policies regarding physical access to executive spaces.
- Observe how the company handles similar incidents involving employee misuse of AI tools for planning misconduct.
- Track legal developments in the case, including any appeals or additional charges.
What it means for organisations
Organisations should review physical security controls for high-value areas, ensuring that unauthorized devices cannot be connected to infrastructure. Teams usually need to verify that employee access rights match their roles, particularly for sensitive conference rooms. Security leaders should check whether existing monitoring systems detect unusual power draws or USB connections. It is vital to inform legal and HR departments about potential insider threats involving physical surveillance. This event underscores the importance of integrating physical and digital security investigations. Organisations must ensure that their incident response plans cover both cyber and physical breaches.
What to do and how to stay safe: OpenAI
- Audit physical access logs for executive and sensitive areas to identify unauthorized entries or lingering devices.
- Inspect USB ports and power sources in meeting rooms for unexpected hardware or connections.
- Review employee usage of AI tools and chatbots for prompts related to building surveillance or recording devices.
- Ensure security teams have protocols for detecting and removing hidden recording devices from office spaces.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who was arrested in connection with the hidden recording device at OpenAI?
Abdulrahman Alfozan, a 35-year-old engineer at OpenAI, was arrested by the FBI for allegedly planting the device.
How did OpenAI identify the person who planted the recording device?
OpenAI used its own AI models to analyze the device and determine that a specific employee had planted it.
What charges is the arrested employee facing?
Alfozan faces federal charges and could receive up to five years in prison, a $250,000 fine, and supervised release if convicted.
