35-year-old OpenAI engineer Abdulrahman Alfozan was arrested and charged with using a wiretapping device after a recording device was found hidden in an executive conference room at the company’s San Francisco headquarters. The device was plugged into a USB port behind a television and wrapped in tissue paper.
Prosecutors said a bag left in the office contained another recording device, along with his wallet and identification card. The room was used for meetings involving OpenAI’s confidential technical and commercial information, product plans, and strategy.
What Happened in the Executive Conference Room
Federal prosecutors allege that Abdulrahman Alfozan, an OpenAI engineer, hid a recording device in an executive conference room to eavesdrop on conversations. He was arrested on Friday and remained in custody after appearing in court for the first time on Tuesday.
The case charges him with using a device to intercept oral communications. Prosecutors consider the room relevant to confidential company information, including research, product plans, and strategic discussions.
Who Is the Defendant, and What Is the Status of the Case?
Abdulrahman Alfozan, 35, is a Saudi national who has worked as an engineer at OpenAI since July 2025. He has been a lawful permanent resident of the United States since September 2020.
Alfozan remains in custody while the case proceeds after his first appearance in federal court on Tuesday. The case is being handled by the U.S. Attorney’s Office for the Northern District of California.
Timeline from Installation of the Device to the Arrest
- Around September 28, the device was installed behind a television in the executive conference room.
- On September 30, an employee found the device. The data on it was encrypted.
- On October 5, a bag was found abandoned in a printer. It contained a wallet, identification card, and a second recording device.
- On October 6, Alfozan came to retrieve the bag, but the second device was already missing.
- Later that Friday, he was arrested on charges of using or attempting to use a device to intercept oral communications.
How the Device Was Hidden and Discovered
The recording device was plugged into a USB port behind a television in the executive conference room and concealed in tissue paper. The contents of the device were encrypted, requiring further examination.
OpenAI’s Technical Surveillance Countermeasures team discovered the device while inspecting the conference room before referring the matter to the FBI.
CCTV Evidence and the Abandoned Bag
Prosecutors said surveillance footage captured Abdulrahman Alfozan near the conference room on multiple days, even though he was not authorized to enter or attend meetings there.
On October 5, he allegedly left a bag inside a printer. Security personnel found a wallet, identification card, and another recording device that appeared similar to the one discovered in the conference room.
What Information Was Searched Using the Chatbot Account?
Prosecutors allege that a chatbot account linked to Alfozan’s spouse shared an identifier with his account. Questions were submitted between September 24 and 30 about building addresses, conference rooms, room capacity, calendars, and meeting locations used by executives and external partners.
The questions also covered how to build, install, conceal, and remotely access a recording device, as well as how to encrypt an SD card. On September 27 and 28, questions concerned the same model of device later found, including the device’s unique MAC address.
What Is the Seeed XIAO ESP32-S3 Sense Device Like?
Court documents identify the device as a Seeed XIAO ESP32-S3 Sense development board, approximately the size of a thumb, making it relatively easy to hide in small spaces.
The board includes a detachable camera sensor, a digital microphone, and a microcontroller for recording audio. These features make the device suitable for recording and storing data on board.
What Types of Information Were Held in the Conference Room?
According to the prosecutors’ filing, meetings in the room often involved several categories of sensitive information, including the company’s technical, commercial, and strategic data.
Examples included proprietary research, product plans, and communications with government agencies. Such information could affect both business direction and technology security.
Examination of the Device and Encrypted Data
After examining the second device, OpenAI found that it contained a recording microcontroller and had been modified to make the stored data difficult to inspect. According to FBI documents, it may also have been connected to intercepted audio.
The team also used AI models to analyze forensic images of the storage area in order to identify changes to the data on the device. Meanwhile, the other device contained encrypted data, meaning the investigation required both hardware analysis and digital forensics.
How Did OpenAI and the FBI Respond?
OpenAI said that after employees found the device, its team used AI models to determine what the device was and where it came from before referring the matter to the FBI.
The FBI said that protecting U.S. AI innovation is one of its important counterintelligence missions. It emphasized that it would take the protection of sensitive research and proprietary technology seriously.
Allegations, Penalties, and What Remains Unconfirmed
Federal prosecutors accuse Abdulrahman Alfozan of using or attempting to use a device to intercept oral communications after a recording device was found in the executive conference room. However, these remain allegations, and he has not been convicted.
If found guilty, he could face up to five years in prison, a fine of $250,000, and three years of supervised release. Details concerning his intent and actual conduct will have to be determined in further court proceedings.
What Does This Case Reveal About Risks to AI Companies?
The primary risk is that the conference room was connected to multiple categories of confidential information, including the company’s research, product plans, commercial data, and communications with government officials, according to court documents. If such information were intercepted or accessed without authorization, it could affect both technology development and business decision-making.
However, the court documents do not yet confirm that any information was actually removed or shared. The allegations currently concern the discovery of an encrypted recording device and another device modified to make detection difficult. The facts will therefore have to be established in court.
From a Discovered Device to a National Security Case
U.S. Attorney Craig Missakian said, “For us, this is a national security matter,” indicating that the case is not viewed merely as a privacy violation within a company.
The case is being handled by the National Security, Cyber & Special Prosecutions Section of the U.S. Attorney’s Office for the Northern District of California. The allegations will now proceed through the court system, while the defendant remains in custody and awaits the legal process.