A former OpenAI engineer has been charged in the United States with allegedly installing a concealed audio recording device in an executive conference room at the company’s San Francisco offices. The criminal complaint describes a device hidden in toilet paper and connected to a USB port behind a television. The allegations have raised questions about insider risk at artificial intelligence companies, where confidential conversations can be as valuable as files stored on a server.
Federal prosecutors identified the defendant as Abdulrahman Alfozan, 35, a Saudi national who joined OpenAI as an engineer in July 2025. He was arrested on October 9 and charged after the device was discovered on September 30. He has not been convicted. OpenAI said it found no indication that he improperly accessed or removed model weights, source code or customer data.
Also Read: AI Agents Are Breaking the Law: But Who Goes to Prison?
What prosecutors allege
According to the US Department of Justice, OpenAI staff found an audio recording device inserted into a USB port on the back of a television in an executive conference room. Investigators believe it was installed around September 28, 2026, and concealed inside toilet paper. The room was used for meetings involving senior company personnel and, at times, government officials. The complaint says those meetings could include confidential technical, commercial and strategic discussions.
Prosecutors allege that Alfozan appeared near the room on multiple dates despite having no authorization to access it or participate in the meetings. A separate device described as similar was reportedly found in a bag linked to him on October 5. Those details form part of the government’s allegations and must be tested through the court process.
The alleged method and digital trail
The case illustrates a potential insider-surveillance pattern. Rather than first penetrating a network, an individual with workplace access allegedly placed a small recorder in a room where sensitive information was discussed. Concealing the device in an ordinary item and connecting it behind a television could allow it to blend into routine office equipment. Investigators say its stored data was encrypted, which may complicate examination, but encryption alone does not establish what was recorded or whether any recording was transmitted to another person.
The complaint also describes a digital trail. Before the device was allegedly installed, Alfozan reportedly used a productivity tool to ask about building locations, meeting rooms, room capacities, calendars and the locations of leadership and external-partner meetings. A chatbot account associated with his spouse submitted prompts about building, testing, concealing, remotely accessing and encrypting a recording device. Prosecutors say those prompts included identifiers linked to the device later found in the room.
These traces may help investigators construct a timeline, but they are not interchangeable forms of proof. Account ownership, who entered each prompt, the context of a query and its connection to physical actions must be established rather than assumed. Digital logs, CCTV, the device itself and forensic analysis can corroborate one another if their provenance is preserved and their timestamps are reconciled.
What is known, and what remains unproven
OpenAI said it used internal AI systems to help identify the device and the employee it believed was responsible, then referred the matter to the FBI. The company said it had no indication that model weights, source code or customer data were accessed or exfiltrated. That statement is important: an alleged attempt to record spoken conversations is serious, but it is not proof that the company’s digital repositories were breached.
At a detention hearing on October 19, a federal judge denied Alfozan’s request for release, agreeing with prosecutors’ concern that he could be a flight risk. Prosecutors raised alleged contacts with a Saudi royal family member involved in recruiting for an AI initiative and travel arrangements for his family. His lawyer argued that Alfozan had strong ties to the United States and that the family travel had been planned before the alleged installation. Those competing accounts relate to detention, not proof of guilt.
The public record does not yet establish what, if anything, the device recorded, who may have received any recordings, or why it was allegedly installed. The charge does not itself prove that a foreign government directed the alleged conduct. Those questions require evidence, not inference from nationality, contacts or timing alone.
The legal framework
The Department of Justice charged Alfozan under 18 U.S.C. § 2511(1)(b), a provision of the federal Wiretap Act addressing the use or attempted use of an electronic, mechanical or other device to intercept oral communications in specified circumstances. The Justice Department says that, if convicted, he faces a maximum of five years in prison, a $250,000 fine and up to three years of supervised release. Any sentence would be decided by the court under applicable law and sentencing rules.
The case concerns alleged interception of conversations, not a public finding that trade secrets were stolen or that espionage occurred. Other legal issues could depend on evidence developed later, including whether confidential information was recorded, used or disclosed. No additional charge should be presumed without a formal filing. The defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt.
Also Read: Where the Truth Ends and the Lie Begins
The security lessons for AI companies
The alleged incident points to a gap that technical network controls cannot close by themselves. Sensitive meeting rooms need documented access lists, physical inspections of equipment, controlled USB connections, tamper-evident checks and clear procedures for securing devices found in restricted areas. Staff access should be reviewed when job responsibilities change, and unusual queries about calendars or restricted locations should be assessed in context rather than treated as automatic proof of wrongdoing.
When a suspected device is discovered, security teams should photograph it in place, record who handled it, preserve CCTV and access logs, isolate it without casually powering it on, and maintain a documented chain of custody for forensic examination. Any review of company AI systems used to investigate an employee should also be auditable, with human oversight and controls over access to personal or sensitive records.
The central question is not only whether one device was planted. It is whether an organisation can detect the convergence of physical access, unusual planning activity and a possible attempt to capture confidential speech before information leaves its control. That assessment will depend on the evidence presented in court and on the security changes OpenAI makes in response.
Forensic Times Investigative Desk
This report distinguishes allegations in a criminal complaint from independently established facts. The defendant has not been convicted, and the motive and any intended use of recordings remain unproven in the public record.
