"According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer's executive conference room to secretly capture sensitive communications about the company's super intelligence technology," said FBI director Kash Patel.
The device, where it was found, and what the company discovered
Federal prosecutors say investigators found a Seeed XIAO ESP32-S3 Sense recording device installed via a USB port in a television in OpenAI's executive conference room on or about September 28, 2026. Staff discovered the device concealed in toilet paper on September 30, and company security later found a second Seeed-manufactured recording device in a bag left in the office printer room on October 5.
OpenAI said it used its models to analyze the device. The complaint alleges the device may have been modified to prevent data transfer between the recorder and the TV and that the contents of the bug's microSD card may have been encrypted; after making a forensic image, company investigators could not retrieve data from the card.
Timeline and the actions prosecutors allege
According to court documents, the engineer named in the complaint, 35-year-old Saudi national Abdulrahman Alfozan, had worked at OpenAI since July 2025 and held U.S. permanent residency since September 2020. He was arrested on October 9 and made his initial federal court appearance on October 13.
Investigators say CCTV footage placed him near the executive conference room on several dates. Court filings include an image taken October 5 from a camera situated behind the TV that the Department of Justice says shows Alfozan checking on the device. Prosecutors allege he had no authority to access or participate in meetings held in that room, which the complaint says is often reserved for highest-level discussions, including non-public and secret technical meetings and those with government representatives.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAlleged digital activity tied to the scheme
The complaint describes a series of AI-related queries attributed to Alfozan and to an AI chatbot account associated with his spouse. Between around August 17 and September 16, 2026, Alfozan allegedly used a productivity agent to ask about company building addresses, meeting rooms, room capacities and calendars, and external-partner meeting venues.
Between September 24 and 30, the spouse-associated chatbot account allegedly submitted prompts about building and modifying an audio-recording device. Those prompts, the complaint says, included questions on recording reliability, how to add browser access and controls, and how to develop a second unit with speech-triggered recording. The complaint also alleges the spouse's account shared installation identifiers, logged IP usage, and user-path references with Alfozan's account.
Bag, missing-items report, and the second recorder
Company security inspected a bag Alfozan left in the printer room on October 5 and found a wallet, an ID card, and a second Seeed-manufactured recorder before Alfozan reported the bag missing, according to the complaint. He retrieved the bag the next day from lost-and-found and later submitted a written report claiming several items were missing, including a credit card, approximately $500 in cash, two AirPods, a set of headphones, sunglasses, and a power bank.
Charges, penalties, and official statements
The Department of Justice charged Alfozan with attempting to intercept oral communications, an offense that carries a maximum sentence of five years in prison and a $250,000 fine. The FBI director framed the case as tied to protecting "American SI innovation" and described the mission as one of the FBI's highest counterintelligence priorities.
OpenAI said it had no indications the individual inappropriately accessed or exfiltrated model weights, source code, or customer data, and that the employee was terminated. The company also noted its security program is intended to defend against a wide range of threats and described the incident as an example of how AI can be used to address sophisticated security threats. The company subsequently installed CCTV covering the executive conference room; it did not have such coverage at the time the complaint says the device was planted.
What this means for technologists and policymakers, OpenAI and enterprise security teams
- Technologists and security teams: The complaint ties physical hardware (a Seeed XIAO ESP32-S3 Sense) to AI-driven queries and accounts, highlighting an intersection of physical device discovery, forensic imaging, and AI-based analysis; the device's alleged modifications and potential encryption complicated data recovery.
- Policymakers and regulators: Prosecutors and the FBI framed the matter as a counterintelligence priority involving meetings with government representatives and "super intelligence" discussions; that framing places such insider-physical-threat allegations in a national-security context.
- OpenAI and enterprise security teams: The company used its models in the device analysis, installed CCTV after the incident, and terminated the employee named in the complaint—concrete responses to an alleged insider threat that combined physical concealment and digital footprints.
Prosecutors have not stated whether the alleged device captured anything of significance; OpenAI reported it could not retrieve data from the card after making a forensic image. The case now moves through the federal courts, where those questions — what, if anything, was recorded, and whether any information was shared externally — remain central to resolving the allegations.
