"On or about Sept. 30, OpenAI personnel discovered a surreptitious audio recording device (Recording Device 1) inserted into a USB port on the back of a television in an executive conference room inside one of their buildings in San Francisco," the U.S. Department of Justice said in its announcement.
The DOJ allegations against Abdulrahman Alfozan
The Department of Justice announced that Abdulrahman Alfozan, 35, a Saudi national who had worked at OpenAI since July 2025, was arrested on October 9 and charged with illegally intercepting oral communications. If convicted, the complaint says Alfozan faces up to five years in prison and a $250,000 fine. The DOJ’s public notice frames the arrest around the discovery of a hidden recording device inside an executive conference room at OpenAI’s San Francisco offices.
The device: where it was installed and what investigators found
According to the DOJ, OpenAI security personnel discovered the first recording device on September 30. It was plugged into a USB port behind a television in an executive conference room, had been concealed in toilet paper, and was installed around September 28. The complaint states the device contained encrypted data.
OpenAI security employees later discovered a second, similar recording device on October 5, the complaint says. That device was found inside a bag Alfozan had left unattended in another room.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadEvidence cited in the complaint: footage, searches, and chatbot prompts
The DOJ complaint links surveillance footage and account activity to the allegation. Security camera footage allegedly showed Alfozan near the conference room on multiple occasions, despite not being authorized to attend meetings held there. On October 5, surveillance footage allegedly captured Alfozan returning to the conference room and looking behind the television where Recording Device 1 had been installed.
Separately, the complaint alleges Alfozan used a productivity tool to search for information about OpenAI’s offices, meeting rooms, executive locations, and meeting schedules. The complaint also alleges that a chatbot account associated with Alfozan’s spouse submitted questions about building and concealing recording devices — including prompts about creating a continuous audio recorder, modifying Wi‑Fi connectivity, improving live listening capabilities, and encrypting an SD card.
More specifically, the DOJ says the same chatbot account submitted prompts tied directly to Recording Device 1 — including its custom header and unique MAC address — between September 27 and September 28, a detail the complaint cites to establish a temporal link between the device and the account activity.
OpenAI’s internal response and referral to the FBI
OpenAI says it used its own AI models to investigate the suspicious device. In a statement posted on X, the company said: "We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier." The company said it terminated the employee and referred the incident to the FBI.
OpenAI also said, in the same statement, "At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data." The DOJ complaint and OpenAI’s statement together place the discovery, internal investigation, termination, and law enforcement referral within a discrete period in late September and early October.
How technologists and security teams, policymakers and regulators, and procurement leaders are likely to react
- Technologists and security teams: They will focus on the operational details reported here — a device concealed in toilet paper, plugged into a USB port behind a television, and containing encrypted data — and on the correlation of physical surveillance footage with account-level activity, including chatbot prompts tied to a device MAC address.
- Policymakers and regulators: The arrest and the DOJ charge for illegally intercepting oral communications may prompt closer attention to workplace surveillance, the intersection of physical and digital investigation techniques, and statutory standards for device interception described in the complaint.
- Procurement leaders and corporate security: Organizations that host executive meetings will likely re-evaluate physical-access controls for conference rooms, USB-port exposures on shared AV equipment, and procedures for inspecting and logging unattended items, given the discovery of a second device in a bag members of staff had left unattended.
The record in the DOJ complaint is concrete on several points — who was arrested, how and where a device was discovered, and what account activity allegedly linked the device to that individual — and it is equally specific about what OpenAI reported finding and doing. The complaint also leaves a narrow set of technical questions standing: for example, the device contained encrypted data, and the complaint ties chatbot prompts to the device by citing a custom header and MAC address; whether and how that encrypted content will be decoded, and what further evidentiary threads it yields, are matters for the ongoing prosecution.
