OpenAI engineer charged with planting covert recording device in executive conference room
The US Department of Justice has charged Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, with attempting to intercept oral communications. He allegedly installed a Seeed XIAO ESP32-S3 Sense recorder in a USB port on a TV in OpenAI's executive conference room around September 28, 2026. Staff found the device concealed in toilet paper on September 30. A second Seeed recording device was later found in his bag. OpenAI says it has no indication of access to or exfiltration of model weights, source code or customer data, and the employee was terminated. The offense carries up to five years in prison and a $250,000 fine.
Detalhes técnicos
- The device may have been modified to block data transfer between the recorder and the TV. Its microSD card contents could not be retrieved from a forensic image, possibly because they were encrypted.
- The complaint alleges that between about August 17 and September 16, 2026, Alfozan used a productivity agent to query building addresses, meeting rooms, capacities, calendars and external-partner venues.
- An AI chatbot account tied to his spouse allegedly shared installation identifiers and IP usage with his account. Between September 24 and 30 it submitted prompts about building and modifying an audio recorder, including speech-triggered recording and browser access and controls.
- There was no CCTV in the room when the device was planted. A camera installed afterwards allegedly captured him checking behind the TV on October 5.
- OpenAI used its own models to analyze the device.
- Alfozan was arrested on October 9. The FBI called the case a top counterintelligence priority.
Remediação
- Add CCTV coverage and access controls for sensitive meeting rooms.
- Run periodic physical sweeps for rogue devices, including on USB ports of room equipment such as TVs.
- Disable or restrict unused USB ports on conference room equipment.
- Monitor insider-risk indicators, including unusual internal queries about rooms and calendars.
Linha do tempo
-
OpenAI engineer charged with planting covert recording device in executive conference room
ler a análise desta fonte ocultar
The US Department of Justice has charged Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, with attempting to intercept oral communications. He allegedly installed a Seeed XIAO ESP32-S3 Sense recorder in a USB port on a TV in OpenAI's executive conference room around September 28, 2026. Staff found the device concealed in toilet paper on September 30. A second Seeed recording device was later found in his bag. OpenAI says it has no indication of access to or exfiltration of model weights, source code or customer data, and the employee was terminated. The offense carries up to five years in prison and a $250,000 fine.
Technical Details
- The device may have been modified to block data transfer between the recorder and the TV. Its microSD card contents could not be retrieved from a forensic image, possibly because they were encrypted.
- The complaint alleges that between about August 17 and September 16, 2026, Alfozan used a productivity agent to query building addresses, meeting rooms, capacities, calendars and external-partner venues.
- An AI chatbot account tied to his spouse allegedly shared installation identifiers and IP usage with his account. Between September 24 and 30 it submitted prompts about building and modifying an audio recorder, including speech-triggered recording and browser access and controls.
- There was no CCTV in the room when the device was planted. A camera installed afterwards allegedly captured him checking behind the TV on October 5.
- OpenAI used its own models to analyze the device.
- Alfozan was arrested on October 9. The FBI called the case a top counterintelligence priority.
Remediation
- Add CCTV coverage and access controls for sensitive meeting rooms.
- Run periodic physical sweeps for rogue devices, including on USB ports of room equipment such as TVs.
- Disable or restrict unused USB ports on conference room equipment.
- Monitor insider-risk indicators, including unusual internal queries about rooms and calendars.