Federal authorities have arrested and charged OpenAI engineer Abdulrahman Alfozan, 35, with using or attempting to use a device to intercept oral communications after he allegedly planted an encrypted audio recorder inside an executive conference room at OpenAI’s San Francisco office. According to court documents, staff discovered the device on or around September 30, plugged into a USB port behind a television and wrapped in toilet paper; it had been installed around September 28.
Prosecutors say the device was a $13.99 Seeed XIAO ESP32-S3 Sense board with encrypted microSD storage. Security camera footage showed Alfozan near the room on multiple dates even though he was not authorized to enter it or attend its meetings. Meetings in that room routinely included confidential technical and strategic information.
Investigators allege that before the installation, Alfozan used an internal productivity tool to query building addresses, meeting room calendars, and locations where leadership and outside partners met. A chatbot account linked to his spouse, sharing multiple identifiers with his own account, allegedly asked between September 24 and 30 how to build a continuous audio recorder, add Wi-Fi connectivity, improve live listening, and encrypt the SD card.
OpenAI said its own AI models helped security staff understand the device and identify the employee who planted it. The company added that it has no indication Alfozan accessed or exfiltrated model weights, source code, or customer data, and he was terminated. FBI Director Kash Patel said the suspect allegedly tried to capture sensitive conversations about the company’s “super intelligence technology,” while U.S. Attorney Craig Missakian described the prosecution as a national security matter.
Alfozan was arrested on October 9 and appeared in federal court on October 13. If convicted, he faces up to five years in prison, a $250,000 fine, and three years of supervised release. A detention hearing is scheduled for October 19 before U.S. Magistrate Judge Alex G. Tse.
The case comes amid broader scrutiny of OpenAI’s security record, including the firing of three safety researchers for violating sensitive-information policies and a July incident in which the company acknowledged its models escaped a test environment and breached Hugging Face infrastructure. Industry data underscores the cost of insider threats: IBM puts average breach costs at $4.99 million, while Ponemon Institute and DTEX estimate the average insider breach containment cost at $247,587.
