OpenAI Engineer Arrested for Planting Spyware Device in an Executive Conference Room

An OpenAI engineer has been arrested for allegedly hiding an audio recording device in an executive conference room at the company’s San Francisco offices. Abdulrahman Alfozan, 35, a Saudi national, was arrested on October 9, 2026, and appeared in federal court on October 13, according to the U.S. Department of Justice.

Prosecutors charged him with using or attempting to use a device to intercept spoken communications. Although described as a spyware device in the headline, the hardware was a hidden audio recorder. The public announcement does not describe malware installed on OpenAI computers.

OpenAI Engineer Arrested for Planting Spyware

According to the complaint, OpenAI staff discovered the first device around September 30. It was plugged into a USB port behind a television, wrapped in toilet paper, and contained encrypted data. OpenAI determined that it had been installed around September 28.

The room hosted highly confidential discussions about research, product plans, business opportunities, government engagements, and technical progress. Prosecutors allege that Alfozan, who joined OpenAI in July 2025, had no authority to enter the room or attend those meetings.

Office CCTV allegedly showed him near the room on several dates before the discovery. Footage from October 5 reportedly showed him entering the room and looking behind the television.

Investigators also examined searches made through a productivity tool. Before September 28, Alfozan allegedly asked about building addresses, room calendars, meeting capacities, leadership locations, and meetings with outside partners.

The complaint describes related prompts from a chatbot account associated with his spouse. Authorities said that account shared several identifiers and attributes with Alfozan’s account. Between September 24 and September 30, it requested help with continuous audio recording, Wi-Fi connectivity, live listening, remote access, concealment, and SD card encryption.

Prompts submitted on September 27 and September 28 allegedly referenced the first recorder’s custom header and unique MAC address. These details form part of the evidence linking the account activity to the recovered hardware. However, requests about remote access do not establish that recordings were transmitted outside OpenAI.

On October 5, security staff also found a similar recorder inside a bag Alfozan allegedly left unattended elsewhere in the office. The bag contained his wallet and identification.

The case concerns alleged physical eavesdropping, not a confirmed network breach. The Justice Department announcement does not identify a foreign recipient or establish that confidential recordings reached another party.

Separately, Cybersecurity News has covered OpenAI’s response to AI reasoning extraction and researchers reaching internal repositories through a forum security flaw. Those reports concern different security paths and are not evidence of a connection to this case.

The FBI is investigating. Assistant U.S. Attorney Nicolas Parker is prosecuting, with support from National Security Division attorney Kate Tagert. According to the Northern District of California announcement, Alfozan faces up to five years in prison, a $250,000 fine, and three years of supervised release if convicted. The charge remains an allegation, and he is presumed innocent unless proven guilty.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post OpenAI Engineer Arrested for Planting Spyware Device in an Executive Conference Room appeared first on Cyber Security News.