A Recorder Hidden Behind a Television

OpenAI has confirmed that staff discovered a concealed audio recording device inside an executive conference room at its San Francisco headquarters, triggering a federal investigation that has now led to criminal charges. According to the U.S. Department of Justice, Abdulrahman Alfozan, a 35-year-old Saudi national who joined OpenAI in July 2025, was arrested on October 9, 2026, and appeared in federal court on October 13. He faces charges related to using, or attempting to use, a device to intercept private conversations.

Employees reportedly found the first device around September 30, plugged into a USB port behind a television in the room and wrapped in toilet paper to avoid detection. The hardware contained encrypted storage, and OpenAI’s own investigation concluded it had likely been installed roughly two days earlier, on September 28.

In a statement posted to its official account, OpenAI said it had used its own AI models to help analyze the device and trace it back to the employee who allegedly planted it, before referring the case to the FBI.

A High-Value Target for Eavesdropping

The targeted conference room reportedly hosted some of OpenAI’s most sensitive internal discussions, covering unreleased research, product roadmaps, prospective business deals, government relationships, and technical progress updates. Prosecutors allege Alfozan had no legitimate business reason to be in the room or to attend the meetings held there, and that office security camera footage placed him near the room on multiple occasions in the weeks before the device was found, including footage from October 5 that reportedly shows him entering and examining the area behind the television.

A Digital Trail Allegedly Linking Suspect to Hardware

Much of the case described in the complaint relies on digital activity rather than the recorder itself. Investigators say that before September 28, an account associated with Alfozan was used to search internal productivity tools for information about building layouts, meeting room calendars, room capacities, the whereabouts of leadership, and scheduled meetings involving outside partners.

The complaint also points to a separate chatbot account, allegedly linked to Alfozan’s spouse, that shared identifying attributes with his own account. Between September 24 and September 30, that account is said to have asked detailed questions about setting up continuous audio recording, maintaining Wi-Fi connectivity for a hidden device, enabling live listening and remote access, concealment techniques, and encrypting data stored on an SD card. Two of the prompts, submitted September 27 and 28, allegedly referenced the exact custom header and MAC address later found on the recovered hardware, a detail prosecutors say directly ties the account activity to the physical device.

It is worth noting that questions about remote access do not, on their own, prove that any recordings were successfully transmitted outside the company. The publicly available charges describe alleged physical eavesdropping rather than a confirmed breach of OpenAI’s network or AI systems.

A Second Device Found in an Unattended Bag

On October 5, security staff located a second, similar recording device inside a bag that Alfozan had allegedly left unattended elsewhere in the office. The bag reportedly also contained his wallet and identification, adding further physical evidence to the government’s case.

Open Questions Remain

Despite the detailed timeline laid out in the complaint, several important questions remain unanswered. The Justice Department’s announcement does not name a foreign government or outside party that may have received any recordings, nor does it establish that confidential OpenAI information actually reached anyone beyond the alleged device itself. OpenAI has not disclosed whether any other rooms, devices, or systems were affected.

Why This Matters for Enterprise Security Teams

The case is a reminder that insider threats are not confined to digital systems. Organizations handling highly sensitive intellectual property, research, or deal information often invest heavily in network security, endpoint monitoring, and access controls, while physical spaces like conference rooms can remain comparatively unmonitored. A hidden, USB-powered recorder is inexpensive, easy to conceal, and can defeat virtually every layer of network-based defense simply by capturing sound in the room.

• Treat unusual internal searches about room locations, calendars, or executive whereabouts as potential indicators worth investigating, much like anomalous network activity.
• Conduct periodic physical security sweeps of sensitive meeting spaces, including checks of USB ports, power outlets, and areas behind screens or furniture.
• Restrict and log badge access to executive areas, and review footage retention policies for high-value spaces.
• Extend insider-risk monitoring programs to cover physical access patterns alongside digital activity.

As AI companies increasingly sit on commercially and strategically sensitive information, incidents like this one suggest that boardroom security deserves the same scrutiny traditionally reserved for networks and endpoints.