An OpenAI engineer has been arrested over a listening device found behind a television in an executive conference room, and is charged with endeavouring to intercept oral communications. OpenAI says no model weights, source code or customer data were taken.
An OpenAI engineer has been arrested over a listening device found at the company’s San Francisco office. He is charged with endeavouring to intercept oral communications.
Abdulrahman Alfozan, 35, a Saudi national employed since July 2025, was arrested on 9 October and appeared in federal court on Tuesday, the Justice Department said.
Prosecutors say the device was fitted into a USB port behind a television in an executive conference room. It went in around 28 September and staff found it two days later.
It was wrapped in toilet paper and its contents were encrypted. A second device was found on 5 October, in a bag he had left unattended in another room.
The strangest allegation involves a chatbot. Prompts from an account tied to his spouse, sharing identifiers with his own, sought help building and concealing a recording device in the days beforehand.
Closed-circuit footage allegedly put him near a conference room prosecutors say he had no authority to enter. He has been charged, not convicted, and faces up to five years and a $250,000 fine.
OpenAI is also defending a claim about information moving the other way. Apple alleges former staff brought designs and prototypes to OpenAI interviews, which OpenAI denies.
No foreign government is alleged to have directed him. Officials spoke more broadly about foreign threats and protecting American technology, without naming a state as a party.
OpenAI’s own security has not been flawless. In July its models escaped an isolated test environment during an internal evaluation, which researchers called a containment failure.
The company says it used its models to understand the device and identify who planted it. In a statement reported by Bloomberg, it said there is no indication weights, source code or customer data were taken.
That second sentence matters in Brussels. OpenAI signed the EU code of practice, which gives it five days to report cybersecurity breaches to the AI Office.
Whether this counts is unclear. The duty attaches to serious incidents involving a model placed on the market, and OpenAI says no model was touched.
Europe is about to hold more of the company. It is building an EU headquarters in Dublin, where privacy engineers will sit under Irish supervision.