On October 13, 2026 (local time), OpenAI announced on X that it had discovered a sophisticated hidden recording device inside the company, identified the employee who installed it, and reported the employee to the FBI. The U.S. Department of Justice also said that day it had charged Abdulrahman Alfozan, a 35-year-old Saudi national and an engineer at the company, with allegedly intercepting or attempting to intercept oral communications using electronic devices. The suspect was arrested on October 9 and made his first appearance in federal court on October 13. These are allegations at the investigation stage; guilt has not been established.
A Small Device Hidden Behind a Conference Room TV
The setting was the boardroom at OpenAI’s headquarters in San Francisco. According to the complaint, around September 30, an employee found a recording device plugged into a USB port on the back of a television. The device was wrapped in toilet paper to conceal it, was allegedly installed around September 28, and had encrypted recordings.
The complaint says the room was frequently used for private discussions about proprietary research and product plans, business development opportunities, government relations, and commercial relationships. Behind the television was a blind spot no one would think to check. For several days, an ear may have been listening in there.
Surveillance cameras reportedly captured the suspect near the boardroom several times before the device was discovered. The complaint says, however, that the suspect was not authorized to enter the room or attend meetings.
A Company That Builds AI Used AI to Investigate the Case
The method of investigation is worth noting. OpenAI said it used its own AI models to analyze how the device worked and where it came from, and determined that a specific employee had installed it a few days before it was found. In effect, a company that develops AI also used AI in an internal investigation.
The company says there is so far no evidence that the employee improperly accessed or took model weights, source code, or customer data. The employee was fired.
OpenAI has presented the case as an example of how AI can help address sophisticated security threats. That said, human review—such as checking surveillance footage and verification by security staff—must also have played a major role. AI was a tool used as part of the investigation, not an all-purpose detection system.
The Preparations Described in the Complaint
The evidence cited in the complaint is strikingly specific. Before September 28, the suspect allegedly used workplace productivity tools to repeatedly look up the company’s address, conference rooms, their capacity and schedules, the whereabouts of “leadership and exec,” and meetings with external partners.
In addition, prompts concerning the design, customization, installation, testing, concealment, and remote access of recording devices were allegedly sent from September 24 to 30 through a chatbot account linked to the suspect’s spouse. The complaint says the account shared multiple identifiers and attributes with the suspect’s own account. The prompts included how to build a device capable of continuous recording, configure a Wi-Fi connection, improve sound quality and live listening, and encrypt an SD card.
Prompts about headers and a MAC address unique to the device that was found were also reportedly sent on September 27 and 28. Logs of conversations with AI can provide clues that help corroborate actions over a period of days—a dynamic characteristic of an era when generative AI has become commonplace.
The October 5 Incident and a Second Device
According to the complaint, the suspect entered the boardroom on October 5 and appeared to peer behind the television where the device had been plugged in. That same day, the suspect left a bag unattended in another room. When security staff opened it, they reportedly found a second recording device resembling the first, along with a wallet and identification documents.
A Case Framed in National Security Terms
The FBI is investigating the case, and the U.S. Attorney’s Office for the Northern District of California is handling the prosecution with assistance from the Justice Department’s National Security Division. Authorities said that if convicted, the suspect could face up to five years in prison, a $250,000 fine, and three years of supervised release afterward.
The language used by officials goes beyond that of an ordinary workplace dispute. FBI Director Kash Patel said the suspect allegedly hid the device to secretly record confidential conversations about the company’s superintelligence technology, adding that protecting U.S. innovation in the field of superintelligence is one of the highest-priority counterintelligence missions. Director of National Intelligence Jay Clayton said winning the global competition over SI (formerly AI) is a national security challenge and emphasized the importance of President Trump’s creation of the “Super Intelligence Force.” The Justice Department said the prosecution is part of efforts under National Security Presidential Memorandum “NSPM-11” to support U.S. superiority in superintelligence technology.
An alleged incident involving a single engineer is being discussed in the language of national strategy. It may be a sign of how AI-company conference rooms are seen as places where information of such significance is gathered.
A wave of personnel changes raises questions about how information is protected
Since the start of October, OpenAI has seen a succession of employees fired or leave the company. On the 8th, three researchers involved in safety research announced they had been fired and sent a letter requesting a written explanation of the reasons. OpenAI said they had violated its rules on handling confidential information. On the 3rd, David Robinson, who oversaw the writing of safety reports, left the company and contributed an article to The Atlantic criticizing its corporate culture. No explanation has been given linking the recording-device incident to these developments.
OpenAI says it views protecting its technology, data and personnel as a matter of national importance, and has designed its security program to address a broad range of threats, from internal misconduct and cybercriminals to state-level attackers. The FBI investigation is ongoing, and the company says it will continue to cooperate.
What stands out about the allegations is that the point of entry was not a network but a USB port in a conference room. No matter how robust a system may be, its safeguards can mean little if the conversation itself is leaked. In the AI era, information security is extending beyond servers to encompass people and the rooms they occupy.
Comments