An OpenAI engineer has been arrested after a hidden microphone was discovered in the room where the company's executives discuss sensitive matters. The case is particularly striking because the company itself, creator of ChatGPT, resorted to its own artificial intelligence models to trace the origin of the device and identify the person responsible.
The United States Department of Justice has charged Abdulrahman Alfozan, 35, a Saudi national, with attempting to intercept oral communications using a recording device. The episode highlights a type of risk rarely discussed in the AI industry's security debates: a physical and internal threat, rather than an external cyberattack.
A device hidden behind the executive boardroom TV
The discovery was made in a conference room reserved for OpenAI executives. According to the federal indictment, highly confidential technical, commercial, and strategic issues are frequently discussed there.
The company's security team located what it described as a "sophisticated recording device" connected to a USB port on the room's television. The device was wrapped in toilet paper and, according to investigators, had been installed around September 28.
Its content is encrypted, so it has not yet been determined what it managed to record, or even if it succeeded in capturing any audio before being discovered.
Security footage places Alfozan near the room
According to the indictment, Alfozan did not have authorization to access that conference room. Despite this, video surveillance cameras reportedly recorded him in the vicinity of the space on several dates prior to the discovery of the device.
Prosecutors also maintain that one of the recordings shows him looking behind the television where the microphone was later found. These are, for the moment, allegations by the prosecution: Alfozan has not been tried and the judicial process remains open.
A forgotten bag with a second device
The Department of Justice notes that the OpenAI security team found a bag in another office room that Alfozan had allegedly left behind. Inside were his wallet, his identification document, and a second recording device.
That discovery, added to the camera footage, is what links the employee to the hidden device, according to the prosecution's version. After the facts became known, the company fired him and referred the case to the FBI.
How OpenAI used its own models to identify the person responsible
In a statement, OpenAI explained that it used its artificial intelligence models to "understand the device and where it came from." Thanks to that analysis, the company claims to have identified that a specific employee had placed the device days before its discovery.
The company presents the episode as an example of how its own tools can be used to respond to sophisticated security threats. However, it has not detailed exactly what type of analysis the models performed or what information about the device or the office was provided to them to reach that conclusion.
What OpenAI says it has not yet verified
The company states that, "at this time," it has no evidence that the employee improperly accessed its model weights, source code, or customer data, nor that such information had left the company. Weights are the internal parameters that determine how an artificial intelligence model functions.
This is a cautious formulation: OpenAI speaks of an absence of evidence so far, not a definitive guarantee. The company added that the FBI investigation is ongoing and that it will continue to cooperate with the authorities. According to its statement, the company's security program covers everything from internal risks to threats from cybercriminals and state actors.
A low-tech attack vector
Beyond the use of artificial intelligence to solve the case, the episode stands out for the rudimentary nature of the method used: a peripheral connected to a USB port on a television in a meeting room. There was no need to breach any computer network, only to physically access the equipment.
The case offers some lessons for companies that handle strategic information in their offices:
Check the USB ports of screens and equipment in sensitive meeting rooms, assessing whether they should remain accessible or be blocked.
Cross-reference access logs for reserved rooms with video surveillance footage, as in this case, the suspect did not have entry permission and was still detected in the area on repeated occasions.
Establish periodic inspections of equipment in high-confidentiality spaces, given that the device remained installed for several days before being found.
Consider internal risk with the same seriousness as external risk, since the main suspect was an employee of the company itself.
A judicial process that has just begun
Alfozan was arrested on a Friday and has remained in custody since then. He made his first appearance before a federal court the following Tuesday. The charge filed against him is the use, or attempted use, of a device to intercept oral communications.
The encrypted content of the device and the progress of the FBI investigation will be decisive in clarifying what information, if any, was actually captured. Until that is clarified, OpenAI maintains that it has not detected any signs of leaks related to its models, source code, or customer data.
Frequently Asked Questions
Who is Abdulrahman Alfozan?
He is a 35-year-old Saudi engineer who worked at OpenAI until he was fired following the discovery of the recording device. He has been arrested and charged by the United States Department of Justice with attempting to intercept oral communications.
What exactly did OpenAI find?
A recording device connected to the USB port of a television in the company's executive conference room. The device was wrapped in toilet paper and its content is encrypted.
How did OpenAI identify the person responsible?
According to the company itself, it used its artificial intelligence models to analyze the device and determine where it came from, which allowed it to link it to a specific employee who had allegedly installed it days earlier.
Did Alfozan have access to OpenAI’s models or data?
The company states that, so far, it has no evidence that the employee improperly accessed model weights, source code, or customer data, nor that such information left the company.
What is the legal status of the case?
Alfozan was arrested on a Friday and appeared before a federal court the following Tuesday. He remains in custody while the FBI investigation continues, and he has not yet been tried.
What charge does the detained engineer face?
He is accused of using, or attempting to use, a device to intercept oral communications in OpenAI's executive conference room.
