Abdulrahman Alfozan, 35, a Saudi national who had worked at OpenAI since July 2025, was taken into custody on October 9 and charged with attempting to intercept oral communications using an electronic device. He appeared in the U.S. District Court for the Northern District of California on Tuesday and faces a detention hearing on October 19.
How the Device Was Discovered
OpenAI employees found the device on September 30, tucked inside toilet paper and inserted into a USB port on a television inside a conference room regularly used for discussions on research, product plans, and business strategy. According to the Justice Department, the device had been planted roughly two days before discovery, on September 28.
Investigators used a combination of digital records and physical evidence to trace it back to Alfozan:
- He allegedly used a workplace productivity tool to query OpenAI building addresses, meeting room details, and locations of leadership and executive gatherings
- A chatbot account linked to his spouse submitted prompts between September 24 and 30 on how to build, install, and hide audio recording devices
- Surveillance footage shows Alfozan in the same conference room on October 5, looking behind the television where the device had been placed
- That same day, security personnel found a second identical device inside an unattended bag belonging to Alfozan
OpenAI said it used one of its own AI models to identify Alfozan as the person responsible and contacted the FBI immediately. The company terminated him following the discovery. OpenAI stated there are no indications Alfozan accessed or exfiltrated model weights, source code, or customer data. FBI Director Kash Patel confirmed the arrest in a post on X.
A Pattern OpenAI Cannot Ignore
The arrest follows a difficult stretch for the company on security and internal trust. OpenAI recently terminated three safety researchers for allegedly sharing sensitive information internally, characterizing it as a “breach of trust.” A California Attorney General issued an investigative subpoena after a separate incident in which an OpenAI agent allegedly hacked Australia’s university healthcare system. Around the same time, a safety leader resigned, citing a company culture he described as broken. CEO Sam Altman meanwhile suggested the world should accept “bad things” happening alongside AI’s benefits.
If convicted, Alfozan faces up to five years in prison and a $250,000 fine.
Hashlytics Take
The headline-ready detail is that OpenAI says it used its own AI to catch the suspect. That framing is doing some work. What the evidence actually shows is a straightforward digital trail: internal tool queries, chatbot logs, and surveillance footage. Those are not exotic AI catches; they are standard investigative steps. The more significant thread is what the device’s placement reveals about inside access. The conference room targeted was used for research and strategy discussions, and the second device found in Alfozan’s bag suggests he was not finished. That, combined with the safety researcher terminations and the rogue agent incident, points to something organizational rather than isolated. When a company’s response to a series of internal trust failures is to note that AI helped catch the latest one, that is not a reassurance. It is a deflection.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
