OpenAI employee charged with planting covert recording device in executive conference room, allegedly using AI chatbots to plan it
Federal prosecutors charged Abdulrahman Alfozan, a 35-year-old Saudi national and US permanent resident who joined OpenAI in July 2025, with using a device to intercept oral communications. He allegedly planted a covert audio recorder in an executive-only conference room no later than 28 September 2026. OpenAI's countersurveillance sweep found the device on 30 September. He allegedly spent weeks querying an internal "productivity agent" and an "AI chatbot", including one account linked to his spouse, for meeting schedules and technical advice on covert recording. OpenAI states it has no indication of access to or exfiltration of model weights, source code or customer data. No motive has been disclosed.
Technical Details
- The device was a Seeed XIAO ESP32-S3 Sense, a thumb-sized development board with a camera sensor, digital microphone and microSD storage. It retails for about $13.99.
- It was allegedly hidden in toilet paper and inserted into a USB port on the back of a TV. The microSD data was encrypted, so OpenAI could not review it.
- The targeted room can only be reserved by executives and executive assistants. It is used for highly confidential discussions on research, products, strategy and government relationships.
- On 5 October, OpenAI security found an unattended bag in a printer room containing a second encrypted Seeed device and Alfozan's personal items. He later reported the bag missing and recovered it from lost and found, but did not mention the second device.
- OpenAI tied him to the device through chat logs, surveillance footage and the bag, and gradually revoked his access. He was fired and arrested the following Friday. He faces up to five years in prison if convicted.
- Alfozan's alleged ties to Saudi consulting groups and a Saudi VC firm were noted by the reporters. No link to any state or organisational sponsor has been established.
Remediation
- Run regular physical countersurveillance sweeps of sensitive meeting rooms.
- Monitor internal AI tool and chatbot usage for reconnaissance patterns, such as queries about executive meeting schedules.
- Control and inspect USB ports and unattended devices in executive areas.
- Phase out access for suspected insiders while the investigation runs.
Linha do tempo
-
OpenAI employee charged with planting covert recording device in executive conference room, allegedly using AI chatbots to plan it
ler a análise desta fonte ocultar
Federal prosecutors charged Abdulrahman Alfozan, a 35-year-old Saudi national and US permanent resident who joined OpenAI in July 2025, with using a device to intercept oral communications. He allegedly planted a covert audio recorder in an executive-only conference room no later than 28 September 2026. OpenAI's countersurveillance sweep found the device on 30 September. He allegedly spent weeks querying an internal "productivity agent" and an "AI chatbot", including one account linked to his spouse, for meeting schedules and technical advice on covert recording. OpenAI states it has no indication of access to or exfiltration of model weights, source code or customer data. No motive has been disclosed.
Technical Details
- The device was a Seeed XIAO ESP32-S3 Sense, a thumb-sized development board with a camera sensor, digital microphone and microSD storage. It retails for about $13.99.
- It was allegedly hidden in toilet paper and inserted into a USB port on the back of a TV. The microSD data was encrypted, so OpenAI could not review it.
- The targeted room can only be reserved by executives and executive assistants. It is used for highly confidential discussions on research, products, strategy and government relationships.
- On 5 October, OpenAI security found an unattended bag in a printer room containing a second encrypted Seeed device and Alfozan's personal items. He later reported the bag missing and recovered it from lost and found, but did not mention the second device.
- OpenAI tied him to the device through chat logs, surveillance footage and the bag, and gradually revoked his access. He was fired and arrested the following Friday. He faces up to five years in prison if convicted.
- Alfozan's alleged ties to Saudi consulting groups and a Saudi VC firm were noted by the reporters. No link to any state or organisational sponsor has been established.
Remediation
- Run regular physical countersurveillance sweeps of sensitive meeting rooms.
- Monitor internal AI tool and chatbot usage for reconnaissance patterns, such as queries about executive meeting schedules.
- Control and inspect USB ports and unattended devices in executive areas.
- Phase out access for suspected insiders while the investigation runs.