On September 30, 2026, staff at OpenAI San Francisco discovered a hidden recording device wrapped in toilet paper behind a TV inside a leadership meeting space in San Francisco. Federal Bureau of Investigation agents arrested 35-year-old engineering lead Abdulrahman Alfozan on October 9, 2026, charging him with using or trying to use a device to intercept oral communications. He had worked on product systems since July 2025. The find prompted a quick company inquiry with help from OpenAI models before federal authorities took over the case [1].
Hidden Recording Device Found Behind Television
OpenAI staff found the bug on September 30, 2026. The hardware was plugged into a USB port on the back of a TV set used for leadership talks, where security teams determined that someone had installed the unit around September 28, 2026. Staff couldn’t inspect its storage right away because the microSD card was encrypted [5].
The private room served as a secure hub where company leaders discussed proprietary research, upcoming business partnerships, and unannounced progress on frontier AI systems and confidential government engagements [1]. Abdulrahman Alfozan had no clearance there [2]. According to filings from the U.S. Attorney’s Office for the Northern District of California, Abdulrahman Alfozan had no permission to attend any executive sessions, yet computer records showed he had used an internal productivity tool to search for San Francisco office addresses, leadership locations, meeting room calendars, room capacities, and executive schedules before the bug appeared. The room was reserved for confidential talks on super intelligence technology [1].
OpenAI told reporters that its security team analyzed the hardware with the help of its own AI models to understand how the unit worked and where it came from [3]. OpenAI called the device sophisticated [2]. Spokesperson Nate Evans confirmed that the bug featured “advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring,” yet OpenAI said in a post on X that it found no sign the suspect accessed model weights, customer data, or source code [3]. OpenAI referred the incident to the Federal Bureau of Investigation [1].
Federal Arrest of Engineer Abdulrahman Alfozan
Federal Bureau of Investigation agents arrested Abdulrahman Alfozan on October 9, 2026, following an inquiry into the San Francisco office security breach. Abdulrahman Alfozan was 35 years old. He completed a data science degree at the University of California, Berkeley, in 2025 before joining OpenAI San Francisco as an engineering lead after earlier engineering stints at Meta and startup Nash [1].
Following his arrest, Abdulrahman Alfozan made an initial appearance in federal court on October 13, 2026, according to the Justice Department [3]. The wiretap charges carry steep penalties. If convicted in the case, designated in court records as US v Abdulrahman Alfozan, he faces up to 5 years in prison, a $250,000 fine, and 3 years of supervised release. Prosecutors with the Justice Department said the charges follow strict federal laws [1]. He remains in federal custody in the Northern District of California. His detention hearing is set for October 19, 2026 [3].
Neither Abdulrahman Alfozan nor his defense lawyer could be reached for comment after the hearing, and an email sent by Reuters to an address linked to him received no answer. Government prosecutors haven’t yet had to prove the allegations at trial, so the claims remain unproven in court filings [3]. OpenAI spokesperson Nate Evans confirmed that the firm fired him after internal reviews tied his badge logs to the device [2].
Covert Recording Device Traced Through Chatbot Account
Federal Bureau of Investigation investigators uncovered digital evidence by reviewing prompts sent to an AI chatbot account connected to the spouse of Abdulrahman Alfozan. The prompts started on September 24. Between September 24 and September 30, 2026, the user of that shared account submitted queries asking the chatbot to “Build a continuous audio recorder,” “Customize Wi-Fi … connectivity,” “Improve audio and live listening,” and “Encrypt the SD card” [1].
Between September 27 and September 28, 2026, the same chatbot account submitted queries containing unique hardware markers, including details about the device’s custom header and its specific MAC address that matched the audio hardware recovered behind the conference room TV. The prompts matched the bug [1]. The chatbot profile shared account identifiers directly with the personal account of Abdulrahman Alfozan, linking the inquiries to his home. It wasn’t casual curiosity, but a series of prompts describing the specific unit recovered by security staff [3].
The find arrived during a period of scrutiny over security practices and information handling at OpenAI San Francisco. Earlier this month, the firm dismissed three safety researchers after an inquiry determined they had violated company policies by sharing sensitive data outside approved channels, a situation reported when OpenAI dismissed safety researchers over sensitive data leaks. That dispute involved policy disagreements. By contrast, the conference room bug involved intentional physical surveillance hardware planted inside an executive suite, showing how AI laboratories face security risks on multiple fronts, ranging from unauthorized sharing of research papers to covert eavesdropping attempts by staff with physical access to company offices in San Francisco [1].
Surveillance Camera Catches Suspect Returning to Room
Closed-circuit security cameras in the building showed Abdulrahman Alfozan walking near the conference room on multiple dates before staff found the bug. He lacked clearance for leadership talks [1]. Security personnel in San Francisco placed a hidden camera directly behind the TV on September 30 to see who would return to service or retrieve the hardware [2].
Later that same day, October 5, security staff found a second small, black audio recorder inside an unattended bag in a different room of the OpenAI building. His wallet lay next to it [1]. Staff discovered the wallet of Abdulrahman Alfozan along with his personal identification card next to the second recording unit, which reporting by The Register identified as physical evidence linking the engineer to listening hardware within company headquarters [4]. Security staff handed all materials to Federal Bureau of Investigation agents [1].
Examining the planted hardware presented hurdles for investigators due to the encryption protecting the microSD card. The card was locked [5]. Security analysts attempted to read stored data from the card but couldn’t open the files without the encryption keys, leaving it unclear how much audio the device recorded between its setup around September 28 and its discovery on September 30 [1]. Can security teams always detect such covert bugs before sensitive strategy talks take place? The recovery of both devices gave federal prosecutors in Northern District of California physical proof to file criminal wiretap charges [2].
Audio Recording Device Investigation and National Security
Federal Bureau of Investigation officials described the inquiry as a significant counterintelligence matter tied to frontier AI development. Director Kash Patel called the probe a priority. Kash Patel, Director of the Federal Bureau of Investigation, said Abdulrahman Alfozan hid the recorder to intercept talks about super intelligence technology [1].
Patel said: “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities”. OpenAI said its security program protects against insider risks, cybercriminals, and nation states. Company officials stated that the planted bug hadn’t compromised customer information or model training weights, a relief after past research errors where systems leaked user images online in a research mistake [1]. The company noted that using its proprietary models helped analysts evaluate the bug and trace where it came from quickly [3]. That inquiry enabled OpenAI to hand over detailed forensic findings to the Justice Department before public disclosure [1].
Abdulrahman Alfozan faces up to 5 years in federal prison and a $250,000 fine if convicted of intercepting oral communications [1]. While prosecutors haven’t stated publicly whether the engineer intended to transmit recorded audio to outside parties, the case remains an active criminal prosecution in the Northern District of California [2]. His upcoming detention hearing on October 19, 2026, will determine whether he remains in custody pending trial [3]. The proceedings will show how federal wiretap laws apply to physical surveillance aimed at commercial AI laboratories [2].
- ONLINE NEWS The Hacker News. (2026, October 14). OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room. The Hacker News. [Article Link]
- ONLINE NEWS Whittaker, Z. (2026, October 13). FBI arrests OpenAI employee accused of planting hidden recording device in conference room. TechCrunch. [Article Link]
- ONLINE NEWS Fairfax, Z. (2026, October 14). OpenAI employee arrested after recording device found hidden in toilet paper. Dexerto. [Article Link]
- ONLINE NEWS Jones, C. (2026, October 14). OpenAI engineer charged after boardroom bug found wrapped in toilet paper. The Register. [Article Link]
- ONLINE NEWS TechSpot. (2026, October 14). OpenAI employee arrested for hiding recording device in executive meeting room. TechSpot. [Article Link]
- ONLINE NEWS Ars Technica. (2026, October 14). Recording device hidden in toilet paper found in top-secret OpenAI meeting room. Ars Technica. [Article Link]
