OpenAI Used Its Own Models to Unmask a Hidden Office Recorder

Federal prosecutors on October 13, 2026, charged OpenAI engineer Abdulrahman Alfozan with hiding a recording device in an executive conference room in San Francisco. The 35-year-old Saudi national was arrested on October 9, 2026, after the company said its own models helped trace the bug to him.

OpenAI said it has no sign he took model weights, source code, or customer data. He has not been convicted. Officials described the case as super intelligence work. The charge on the docket is a wiretap count.

A USB Port Behind the Executive Television

OpenAI staff found the device on or about September 30, 2026, during a regular security sweep of a conference room inside one of the company’s San Francisco buildings. It sat in a USB port on the back of a television, wrapped in toilet paper, with its stored data encrypted.

The company later put the install date at or about September 28, 2026, two days before the sweep. Meetings in that room, prosecutors said, often covered confidential research, product plans, business deals, technical progress, and talks with the government.

OpenAI spokesperson Nate Evans said Alfozan joined in July 2025 and worked on the product team, about 15 months before the arrest. The criminal complaint, which identifies the firm only as Company 1, says he had no authority to use the executive room or sit in its meetings.

OpenAI told investigators the hardware monitored audio, used advanced encryption, and had a way to move data that was built to dodge monitoring. That is the company’s basis for calling it sophisticated. The concealment method in the complaint is still toilet paper in a television USB port.

On or about October 5, 2026, OpenAI security opened a bag Alfozan had left in a different room and found his wallet, his ID, and a second recorder like the one in the television. Two devices, one planted and one carried. OpenAI has said it also has evidence he meant to place more of them.

How OpenAI Tied the Device to One Engineer

Closed-circuit cameras in the office showed Alfozan near the executive room on several dates before the discovery, according to the complaint. After the first recorder came out of the television, the company added a camera in that room. Footage from October 5 shows him going in and looking behind the set.

OpenAI said it performs technical surveillance sweeps as a matter of routine. After this one, investigators fed forensic images of the device’s storage, and of data changes on it, into the company’s own models and combined that output with human analysis. That mix, the company said, pointed to a specific employee.

Access was cut back over the following days, then shut off. Equipment was seized. He was placed on leave. OpenAI said the firing and the arrest both landed on October 9, nine days after the sweep. The public note that followed spent as much space on the models as on the arrest, which is a capability claim sitting on top of a personnel case.

We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re…

— OpenAI Newsroom (@OpenAINewsroom) October 13, 2026

The FBI’s investigation is ongoing, the company said, and it will keep helping. At this time, it added, there are no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data.

The Chatbot Account Asked How to Hide a Recorder

Before the install date, Alfozan used a productivity tool to ask about OpenAI building addresses, meeting rooms, room sizes and calendars, and where “leadership and exec” and outside partner meetings were held, the complaint says. The planning trail ran through software the company itself issues to staff.

A chatbot account tied to Alfozan’s spouse, which prosecutors say shared identifiers and attributes with his own account, submitted prompts from September 24, 2026, through September 30, 2026, a seven-day window that covers the install and the discovery. Some of those prompts named the hardware that later came out of the television.

PROMPTS CITED IN THE COMPLAINT

• The build: Queries on building, customizing, installing, testing, hiding, and remotely reaching an audio device, including how to “build a continuous audio recorder.”
• The link: Questions about customizing Wi-Fi connectivity and improving audio and live listening.
• The lock: A request about encrypting the SD card, matching the encrypted storage OpenAI later could not read.
• The fingerprint: Prompts on September 27 and 28, 2026, that referenced Recording Device 1’s custom header and unique MAC address.

Asking a chatbot how to encrypt a memory card, then hiding the result in toilet paper, is a long way from a classic intelligence implant. It is also a direct paper trail. The same class of model that allegedly helped plan the recorder is the class OpenAI says it used to understand the hardware and where it had come from.

Prosecutors Charged a Wiretap Count

Alfozan is charged with intentionally using, or trying to use, an electronic, mechanical, or other device to intercept oral communications, a count under using a device to intercept oral communications in 18 U.S.C. § 2511(1)(b). If convicted, he faces a maximum of 5 years in prison, a $250,000 fine, and 3 years of supervised release.

The case is being handled by the National Security, Cyber & Special Prosecutions Section of the U.S. Attorney’s Office for the Northern District of California. The FBI ran the investigation. The U.S. Attorney’s Office described OpenAI in its announcement as a super intelligence company, using the letters SI in parentheses beside artificial intelligence.

THE CHARGE VERSUS THE PUBLIC FRAME

Patel put the bureau’s SI work on the same shelf as counterintelligence. Missakian said Silicon Valley’s next technology is American innovation his office will protect. Special Agent in Charge Scott Schelble of the FBI’s San Francisco Field Office warned that any attempt to take protected information from U.S. super intelligence companies threatens both innovation and national security.

Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology. Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities.

Kash Patel, FBI Director, Justice Department announcement, October 13, 2026

That is the frame. The filing still has to prove an oral-intercept count. No espionage statute appears in the charge list released with the arrest.

What the Complaint Leaves Open

FBI Special Agent Lydia Liang signed the affidavit supporting the 11-page criminal complaint in United States v. Alfozan, case 3:26-mj-71329, filed October 8, 2026, in the Northern District of California. The alleged window runs from no later than September 28 through no earlier than October 5. A complaint is an accusation. Alfozan is presumed innocent unless a court finds him guilty.

The papers do not name a handler, a buyer, or a foreign service. They do not say the encrypted files on Recording Device 1 were ever read. They do not charge theft of model weights. Saudi nationality is in the caption because that is how prosecutors identified him, not because the count is a spy statute.

WHAT WE KNOW

• The hardware: A recorder in a television USB port, found September 30, plus a second similar device in a bag on October 5.
• The ID path: Office cameras, a later camera behind the television, chatbot prompts that cited the device’s MAC address, and OpenAI’s model-assisted review.
• The charge: One count under 18 U.S.C. § 2511(1)(b), with a 5-year maximum if there is a conviction.

WHAT IS UNCONFIRMED

• The audience: Who, if anyone, was supposed to receive the audio has not been alleged in the unsealed papers.
• The playback: Whether any meeting in that room was successfully captured and reviewed remains unstated, because the first device’s contents were encrypted.
• The extra bugs: OpenAI says it has evidence of plans to plant more recorders; that claim has not been charged as a separate count.

Motive is the hole in the middle of the case. An engineer on the product team had been on staff since July 2025, used internal tools to map executive rooms, and, prosecutors say, walked a recorder into a space he was not allowed to book. That can be self-dealing, leaking, or something the FBI has not put on paper yet. The investigation is the place that question still lives.

Federal Custody Until the October 19 Hearing

FROM THE USB PORT TO FEDERAL COURT

1. July 2025: Joins OpenAI as an engineer on the product team, according to the company and the complaint.
2. September 24, 2026: A chatbot account associated with his spouse begins a week of prompts on building and hiding an audio recorder.
3. September 28, 2026: Recording Device 1 is installed in the executive television USB port, prosecutors allege, the same day prompts cite its MAC address.
4. September 30, 2026: OpenAI’s sweep finds the recorder; stored data is encrypted.
5. October 5, 2026: He enters the room and looks behind the television; security finds a second recorder in an unattended bag.
6. October 8, 2026: Liang’s complaint is filed before Magistrate Judge Alex G. Tse.
7. October 9, 2026: Arrest and termination, nine days after the device was found.
8. October 13, 2026: Initial appearance in San Francisco; the case is unsealed; he is remanded to federal custody.
9. October 19, 2026: Detention hearing before Judge Tse.

He remains in federal custody ahead of that October 19, 2026, hearing. Prosecutors have not added a weights-theft count. OpenAI has not reported a customer-data loss. The models the company sells sat on both sides of the episode, first in the prompt log prosecutors cite and then in the forensic review the company says led it to one badge.

Disclaimer: This article is news reporting on unsealed court papers and company statements, and it is for information only. It is not legal advice, does not decide guilt, and does not tell anyone how to handle a criminal investigation, an employment dispute, or a security review. Readers with a legal question about these charges or about workplace searches should consult a licensed criminal-defense or employment lawyer in the relevant jurisdiction. Names, dates, charges, and custody status come from the sources cited as of the dates on those documents and can change as the case moves.