OpenAI Engineer Charged Over a Recorder Hidden in Toilet Paper Behind an Executive Conference Room TV
Security / news
OpenAI Engineer Charged Over a Recorder Hidden in Toilet Paper Behind an Executive Conference Room TV
The complaint against Abdulrahman Alfozan describes a USB audio device found on Sept. 30, a second one in a bag on Oct. 5, and chatbot prompts about building both. OpenAI and prosecutors disagree on his job title.

A USB audio recorder wrapped in toilet paper was plugged into the back of a television in an OpenAI executive conference room in San Francisco, federal prosecutors allege, and the engineer they accuse of putting it there was arrested on Oct. 9 (charge: intercepting oral communications, unproven, no plea reported).
The Justice Department's Oct. 13 press release names the defendant as Abdulrahman Alfozan, 35, a Saudi national employed at OpenAI since July 2025. He made his first federal court appearance on Oct. 13 in the Northern District of California. A detention hearing before U.S. Magistrate Judge Alex G. Tse is set for Oct. 19, according to the San Francisco Standard.
What the complaint alleges, by date
The allegations come from the complaint as summarised by the Justice Department. None has been tested in court.
| Date | Allegation | Reported by |
|---|---|---|
| Sept. 24 to 30 | A chatbot account tied to his spouse, sharing identifiers with his own, submitted prompts about building a continuous audio recorder and encrypting an SD card | DOJ |
| Sept. 27 to 28 | The same account asked about the specific device later found, including its MAC address | DOJ |
| About Sept. 28 | Recording Device 1 installed behind the television | DOJ |
| Sept. 30 | OpenAI personnel find the device; its contents are encrypted | DOJ |
| Oct. 5 | He re-enters the room and looks behind the television; a bag left in another building holds a second device, his wallet and his ID | DOJ |
| Oct. 9 | Fired and arrested | TechCrunch, DOJ |
Before the installation, prosecutors say, he used a productivity tool to ask about OpenAI's building addresses, meeting rooms, room capacities, calendars and where executives and partners met. CCTV allegedly shows him near the room on several earlier dates, although he had no authority to enter it or attend meetings there.
Who says what about the device
OpenAI told TechCrunch the device had "advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring." TechCrunch wrote that it is unclear how technically distinct that makes it from other recording devices. The description is of a physical implant with encrypted local storage, so someone would have had to come back and collect it.
TechCrunch also reports that OpenAI had placed a camera behind the television, and that prosecutors say it recorded him looking there. OpenAI said it used its own models to analyse the device and forensic images of its storage before referring the matter to the FBI.
FBI Director Kash Patel said, in the quote TechCrunch carries, that the scheme aimed to "capture sensitive communications about the company's super intelligence technology." U.S. Attorney Craig Missakian told the San Francisco Standard: "For us it is a matter of national security." The Justice Department release says the case supports National Security Presidential Memorandum 11.
What OpenAI says was not taken
OpenAI says it has "no indications of this individual inappropriately accessing or exfiltrating model weights," source code or customer data. That is the company's statement, not a finding in the complaint, and a recorder in a meeting room would not touch those systems in any case. It captures what is said aloud, which the San Francisco Standard reports included proprietary research, product plans and government engagements.
The two accounts of his role differ. Prosecutors call him an engineer. OpenAI spokesperson Nate Evans told TechCrunch he worked on the product team. The Hacker News cites a LinkedIn profile calling him an engineering lead.
Neither Alfozan nor his attorney could be reached by TechCrunch. The complaint, as summarised, does not say who the recordings were meant for, and it does not say whether the second device was ever placed. Assistant U.S. Attorney Nicolas Parker and National Security Division trial attorney Kate Tagert are handling the case.
What other companies can take from it: Oct. 19 and after
The device was found by a sweep, not by a log. That echoes the Ledger case, where a hardware implant surfaced through physical inspection of a product. Software audit trails miss a USB device that never speaks to the network.
Cheap controls follow from the dates: block spare USB ports on room displays, sweep rooms where board or partner meetings are held, and review badge and CCTV records for people who appear near rooms they have no meetings in. OpenAI's own math manuscripts release shows how much of its work sits in documents and discussion that never reach a repository.
The next fixed date is the Oct. 19 detention hearing.
Sources
More in Security
- 01PyPI Wheels Carry Binaries Nobody Can Tie to Their SourcePython developer Artem Golubin argues that clean source can ship beside a malicious wheel, and the May 2026 TanStack incident shows a valid signature does not settle it.
- 02Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedThe Oct. 13 release is a record by BleepingComputer’s count, but three trackers report three different totals and the exploited bug needs a user to open a file.
- 03Broadcom Wi-Fi Bug Has No CVE and No Patch on Belgian GatewaysResearcher Quentin Kaiser says a WPS overflow in Broadcom’s SDK dates to at least 2010 and lets an attacker in radio range run code without the network key.
- 04Palo Alto Patches PAN-OS CVE-2026-0322 as Attackers Reach Management InterfacesThe flaw gives an authenticated administrator root on the firewall. Palo Alto lists no workaround, and CISA gave federal agencies three days.