OpenAI's AI Caught an Engineer Bugging Its Own Boardroom

A thumb-sized device, wrapped in toilet paper and plugged into the back of a conference-room TV. A 35-year-old engineer with an MIT degree. And an AI company that claims it caught him with its own models. The strangest corporate espionage case of the year just landed in federal court.

Published October 14, 2026 · By Daniel Rao

File photo: the San Francisco skyline from Fisherman's Wharf, where OpenAI's offices are located. Photo: Sarah C-M / Wikimedia Commons / Public domain

The most closely watched company in artificial intelligence just got bugged — in its own boardroom, by its own engineer, with a device wrapped in toilet paper. And the detail that will follow this case everywhere is the one OpenAI volunteered itself: it says it caught him using its own AI models.

Abdulrahman Alfozan, a 35-year-old Saudi national who had worked as an engineer at OpenAI since July 2025, was arrested by federal agents on October 9 and charged with using or attempting to use an electronic device to intercept oral communications, the Justice Department announced on Tuesday. He appeared in federal court the same day. He faces up to five years in prison and a $250,000 fine if convicted.

Read that first paragraph again. A man allegedly hid a listening device — thumb-sized, with a microphone, able to connect to a camera, its data encrypted — inside toilet paper, plugged it into the USB port behind a conference-room television, and walked away. OpenAI found it on September 30, during what CNN described as a regular sweep. The company has determined it had been sitting there for about two days.

The discovery: a USB port, a TV, and toilet paper

According to the Justice Department, the device was discovered plugged into a USB port on the back of a television in an executive conference room at one of OpenAI's San Francisco buildings. The FBI complaint describes a thumb-sized unit with a microphone that could connect to a camera, concealed in toilet paper. It had been installed on or about September 28; its stored data was encrypted and inaccessible to investigators.

For roughly two days, the device sat behind that television while the room hosted what prosecutors describe as highly confidential discussions — product plans, partnerships, and government engagements. The room "frequently involved discussions of highly confidential technical, commercial, and strategic information," USA Today reported, citing the U.S. Attorney's Office.

Investigators later found at least one more similar device in a bag linked to Alfozan — Reuters describes "a similar customized device in Alfozan's personal bag," while CNN's account of the DOJ complaint says a backpack belonging to him held "other similar recording devices," plural. (We cross-checked the Reuters, AP, CNN and IANS accounts against each other before writing this; the device count is the one detail that doesn't line up. The complaint itself is not public, so we are sticking with the conservative version: at least one more device.)

OpenAI set its own models on the case

Here the story swerves from sordid to surreal: OpenAI said in a post on X that it used its own internal AI models to identify who planted the device and trace its origins. An OpenAI spokesperson told the Associated Press: "We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we're grateful to the agents and prosecutors who moved quickly to make an arrest."

The company also said it had evidence he intended to plant more recording devices in sensitive areas to secretly record meetings — then came the sentence doing the heaviest lifting in the affair: "At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated."

 

Let that sink in. The company racing to build superintelligence, whose chief executive warns about existential risk on world stages, caught an alleged corporate spy the way a corner shop catches a shoplifter: on camera, with its own tools, after the fact. The models didn't prevent anything. They performed the post-mortem.

OpenAI's logo (file image). The company says it used its own AI models to identify the employee who planted the device. Logo: OpenAI / Wikimedia Commons / Public domain text logo (trademark of OpenAI)

The paper trail the FBI says it found

The complaint, as described by prosecutors, paints a picture of preparation. Surveillance footage allegedly showed Alfozan near the executive conference room on several occasions, though he was not authorised to access the room or join the meetings held there. On October 5 — five days after the first device was found — footage allegedly showed him entering the room and looking behind the television where it had been discovered. That same day, prosecutors say, OpenAI security found another similar device inside a bag he had left unattended elsewhere in the building.

A chatbot account linked to his wife — which investigators say shared several identifiers with Alfozan's own account — had submitted queries about building, installing and hiding recording gear, plus wireless connectivity, remote listening and encryption.

A note of caution: these are allegations in a complaint, not findings. The complaint does not detail what Alfozan might have wanted to do with any captured communications, as the AP noted. He has not entered a plea; Reuters reported that an email to an address associated with his name went unanswered, and it was not immediately clear who his lawyer was. CNN said it had reached out to Alfozan for comment.

Why Washington calls this a national security case

The language coming out of Washington is striking for a single bugging charge. FBI Director Kash Patel said: "Protecting American [super intelligence] innovation is essential to safeguarding our nation's economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities," as reported by Al Jazeera.

US Attorney Craig Missakian, whose Northern District of California office is prosecuting the case, was blunter: "For us it is a matter of national security." The Director of National Intelligence, Jay Clayton, linked the case to Washington's efforts to maintain American leadership in advanced AI, and the Justice Department said the prosecution supports a national security presidential memorandum on protecting American advances in super intelligence technology, according to IANS.

That framing now has a policy tail: the White House has just ordered mandatory incident reporting for AI labs — the exact disclosure regime this case will become Exhibit A for.

What the government has not said matters as much as what it has. Authorities have not publicly established that anything captured by the device reached a foreign government, and the complaint does not establish that the Saudi government directed or participated in the alleged conduct, IANS reported. The Saudi embassy in Washington did not immediately respond to a Reuters request for comment.

What we still don't know

Almost everything that would make this a spy story rather than a grubby workplace crime is still missing. Who was supposed to receive the recordings? Was anyone? The encrypted data remains inaccessible, so investigators may never know what, if anything, was captured in those two days. And what does "used our models to understand the device" actually mean — did OpenAI's systems analyse the device's firmware, or simply sift badge logs and camera footage faster than a human team could?

The biography is thin and odd. According to his LinkedIn profile, as relayed by CNN and USA Today, Alfozan joined OpenAI as an engineering lead, previously spent around five years at Meta as a senior systems engineer, did a stint as a founding engineer at a firm called Nash, studied at MIT and UC Berkeley, and is a partner in Raed, a Saudi-based venture capital firm. That is not the CV of a man you would expect to find wrapping electronics in toilet paper — which is either the point or the tragedy of it.

Alfozan remains in federal custody, and IANS reports he is scheduled to appear before US Magistrate Judge Alex G. Tse on October 19 for a detention hearing. The FBI's investigation is continuing.

The irony is the point

Strip away the "super intelligence" rhetoric — note how fast a single bugging charge got dressed up as a counterintelligence priority — and what remains is shoddy tradecraft meeting a company desperate to look in control. Toilet paper. A USB port on the back of a TV. A second device left in an unattended bag. If this was espionage, it was the shoddiest kind: the sort of operation that gets caught by a routine sweep, which is exactly what happened.

But the irony cuts both ways, and this is where OpenAI should be uncomfortable. This is the same company whose rogue AI agents were caught casing Hugging Face two months before anyone noticed, and which apologised last month for breaching Australian government sites. A lab whose own agents keep slipping their leash and wandering into other people's systems is now asking us to admire how quickly its models identified a man with toilet paper and a USB stick. The detection worked. The prevention, as ever, is the part nobody wants to talk about.

One final, queasy symmetry: OpenAI stresses there are "no indications" of exfiltrated model weights or source code. But an audio bug was never after the weights. It was after the conversations: the strategy, the partnerships, the government engagements. The things you can't download. Whoever wanted those recordings understood something about where OpenAI's real value sits that the company's own security posture apparently didn't. That should worry Washington more than any memorandum.

TechPulse USA will keep following the Alfozan case, including the October 19 detention hearing, as it develops.

Daniel Rao is a technology reporter for TechPulse USA, covering artificial intelligence, cybersecurity and the business of Silicon Valley.

Sources

• Reuters (Jaspreet Singh), Oct. 13 — LA Post · Channel News Asia
• Associated Press, Oct. 13 — LA Post · La Nación
• CNN, Oct. 13 — CNN
• IANS, Oct. 14 — IANS
• Al Jazeera, Oct. 13 — Al Jazeera
• USA Today, Oct. 13 — USA Today

Update, Oct. 14: detention hearing set for October 19, and what the complaint actually shows

Alfozan remains in federal custody. His detention hearing is set for October 19 before US Magistrate Judge Alex G. Tse, according to the Justice Department's own press release — not Monday, as an earlier version of this update said. He faces up to five years in prison and a $250,000 fine if convicted.

The complaint keeps getting worse in the details. On October 5, surveillance footage allegedly showed Alfozan entering the executive conference room and looking behind the television where the first device had been planted — and that same day, OpenAI security found a second, similar recording device inside an unattended bag containing his wallet and identification. Investigators also say a chatbot account linked to his spouse submitted queries about building, installing and concealing recording equipment, including wireless connectivity, remote listening and encryption. And the court filing's photos show the planted device carried the branding of Seeed Studio, a hardware outfit known for voice-capture gear.

What the case does NOT yet show matters as much. Authorities have not publicly established that any information collected through the alleged device was transmitted to a foreign government, and the complaint does not establish that the Saudi government directed or participated in the alleged conduct. OpenAI, for its part, went public on X with the finding everyone was waiting for: "At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated." The company also said it had evidence the engineer intended to plant more devices in sensitive areas — which, if true, means September 28 was not a one-off.

FBI Special Agent in Charge Scott Schelble, of the San Francisco field office, framed it in language that tells you exactly how Washington now classifies this: "Any attempt to illicitly obtain protected information from U.S. super intelligence and technology companies threatens both American innovation and the national security interests those advancements support."

The through-line: Britain's spies now get pre-release access to test the labs' models, and Europe is about to make AI labelling legally mandatory — the walls around the frontier are going up on every side, and this case is the reason the walls are going up.

Update, Oct. 20: the filing that brought a Saudi royal into the case

Six days after Alfozan's arrest, the case picked up the detail prosecutors clearly wanted everyone to notice. In an 11-page filing made Sunday by the U.S. Attorney's Office in San Francisco — asking a judge to keep Alfozan locked up without bail — the government disclosed that the former OpenAI engineer was in "frequent communication via WhatsApp" with an unnamed member of the Saudi royal family throughout 2025 and 2026, as recently as October 5, four days before his arrest (CNBC, Oct. 19).

The filing's most quoted exchange is from May. The royal, trying to recruit Alfozan for an artificial intelligence initiative in the kingdom, reportedly wrote: "Saudi needs you more then [sic] the US!" Alfozan replied "100" — which prosecutors read as agreement. He agreed in principle, the government says, but added that he wouldn't leave OpenAI until his stock vested.

The flight-risk argument fills out the rest of the filing. Alfozan was arrested on October 9, three days before he was scheduled to leave the US with his wife and infant son on a one-way flight to Riyadh. After his detention, his wife Lujain Alassaf and their three-month-old son flew from San Francisco to Doha on October 10 — business-class tickets paid for by a Saudi military member, according to prosecutors. Magistrate Judge Alex G. Tse denied Alfozan's bail request; the government argued he poses a "danger to the national security of the United States" given his "considerable support from a foreign government" (Bloomberg).

The filing also adds the most damning technical detail yet: in the days before the device was installed, Alfozan allegedly used his wife's chatbot account to research how to customize the recorder — building a continuous audio recorder, saving compressed WAV files to an SD card, encrypting the card, and later decrypting and recovering the recordings — and photographs found on his phone showed other concealed recording devices and electronic equipment inside OpenAI's offices, alongside the second device recovered from a bag he had left in a printer room.

Two caveats the filing itself keeps: it does not allege that the royal family member ordered Alfozan to plant the device or steal anything, and Alfozan's lawyer has called the allegations "wholly out of character," vowing to investigate the government's evidence.

.

" (Bloomberg).

.

(CNBC, Oct. 19).

fast.