OpenAI’s Office Bug Targeted the Executive Conference Room

OpenAI said a product engineer hid a recording device in an executive conference room, and the FBI arrested him on October 9. The company told the public it found no sign he took model weights, source code, or customer data.

The complaint unsealed in San Francisco describes a different prize. The room was reserved for leadership meetings, product sessions, and briefings with government officials, and the hardware was built to capture speech.

Toilet Paper, a USB Port and an Executive TV

OpenAI personnel found the recorder on or about September 30, 2026, during a sweep of an executive conference room in one of the company’s San Francisco buildings. It had been stuffed into a USB port on the back of a television and wrapped in toilet paper.

The company later determined the board had been installed on or about September 28, the same day its firmware appeared to have been compiled. That left it in the room for two days before the sweep.

There was no camera inside that room when the device went in. OpenAI still had hallway and office CCTV, and those cameras had already been watching a man who did not belong in the space.

The employee was Abdulrahman Alfozan, 35, a Saudi national and a U.S. legal permanent resident since September 2020. He joined OpenAI’s product team as an engineer in July 2025. The company fired him on October 9, the day of the arrest, and said it had evidence he planned to plant more recorders in other sensitive rooms.

The Meetings Were the Asset Worth Bugging

In the complaint, OpenAI is “Company 1,” a super intelligence firm that “employs thousands of people” and runs large generative models plus a chatbot. The targeted space is Conference Room 1. Company representatives told agents it can be reserved only by executives and executive assistants.

They said it is typically used for internal leadership meetings, technical and product sessions, and external briefings with government officials and business counterparts. The conversations, they said, often cover proprietary research, product plans, business-development opportunities, technical progress, government engagements, and commercial relationships.

Alfozan had no authority to enter that room or sit in those meetings, the complaint says. He still spent September hovering around it.

Labs spend their public security talk on model weights, the giant files that define a trained system, and on source code and customer data. OpenAI’s own first statement after the arrest went straight to those three. The hardware in the wall was a microphone on a cheap board. It did not need a cluster login. It needed a room where people still say the quiet parts out loud.

Alfozan Asked OpenAI’s Own Calendar Agent

Between August 17, 2026, and September 16, 2026, the complaint says Alfozan used a productivity agent to ask about building addresses, meeting rooms, capacities, calendars, and where “leadership and exec” and outside partners were meeting. Those queries ran for 30 days. Several of them read like a person trying to learn which rooms matter and whether talk in those rooms is already on tape.

THE CALENDAR AND CHATBOT QUERIES

• August 17: He asked what meeting a presentation had been given at, when it happened, and whether it was recorded.
• August 18: He asked how to send USPS mail to the building, then clarified that it was not a front-desk delivery.
• September 16: He asked the agent to list that day’s meetings in a specific room and where it had found the room calendar.
• September 16: He asked whether another building was now the mailing site, then asked about leadership and executives.
• September 24 to 30: A chatbot account tied to his spouse, which shared identifiers with his own account, asked about building, hiding, testing, and remotely reaching an audio device, including a continuous recorder, Wi-Fi, live listening, and SD-card encryption.
• September 27 to 28: The same chatbot account submitted prompts about the planted board itself, including its custom header and unique MAC address.

The spouse-account prompts are not a side note. They line up with the week the firmware was compiled and the week the board went into the television. Prosecutors have not said who sat at that keyboard. They have said the accounts shared multiple identifiers.

$13.99 Bought a Camera, a Mic and Wi-Fi

FBI Special Agent Lydia Liang’s affidavit names the hardware: a Seeed XIAO ESP32-S3 Sense, a thumb-sized development board with a detachable camera sensor, a digital microphone, and microSD storage. Seeed, the affidavit notes, is based in Shenzhen, China, with manufacturing in Asia and offices around the world.

Seeed Studio lists the board at $13.99 and sells it as a hobby and edge-AI kit with camera, microphone and microSD storage, 2.4 GHz Wi-Fi, Bluetooth, 8 MB of PSRAM, and 8 MB of flash. OpenAI called the same object a sophisticated recording device. Both descriptions can sit on one table. One is a product page. The other is a company that just found it in an executive wall.

Company staff who pulled the board found that the USB adapter may have been modified so the recorder would not pass data through the television. Power and a hiding place were enough. The microphone and the radio did the rest, if the build matched the chatbot prompts about Wi-Fi and live listening.

A forensic image of the microSD card did not yield playable files. Liang wrote that none of the files could be recovered or decrypted. The scraps that came back included a MAC address and a custom header, NANOVOL1, which she described as a layout consistent with a possibly encrypted file system. So the two days of audio, if any was stored, are not in the public paper.

What the FBI Complaint Charges

The case is United States v. Alfozan, No. 3:26-mj-71329, filed October 8, 2026, in the Northern District of California. Liang’s affidavit by Special Agent Lydia Liang supports a single count: intentionally using or endeavoring to use a device to intercept oral communications, in violation of 18 U.S.C. § 2511(1)(b).

If convicted, Alfozan faces a maximum of five years in prison and a $250,000 fine, then three years of supervised release. A complaint is an accusation. The Justice Department’s own release says he is presumed innocent unless a jury finds otherwise.

Assistant U.S. Attorney Nicholas Parker approved the form. U.S. Magistrate Judge Alex G. Tse took the sworn complaint by telephone on October 8. Alfozan was arrested on October 9, made his first appearance on October 13, and remains in federal custody. He is next due in court on October 19, 2026, for a detention hearing before Judge Tse.

FROM THE USB PORT TO FEDERAL COURT

1. August 17, 2026: Alfozan begins querying a productivity agent about meetings and whether they were recorded.
2. September 24, 2026: A chatbot account associated with his spouse starts asking how to build and hide a continuous audio recorder.
3. September 28, 2026: Firmware on the seized board appears to have been compiled, and OpenAI later puts the installation on or about this date.
4. September 30, 2026: A countersurveillance sweep finds the wrapped board in the television USB port.
5. October 5, 2026: CCTV shows Alfozan inside the room looking behind the television; security opens an unattended bag and finds a second similar recorder with his wallet and ID.
6. October 8, 2026: Liang swears out the complaint.
7. October 9, 2026: The FBI arrests Alfozan and OpenAI fires him.
8. October 13, 2026: He appears in federal court; the complaint is unsealed.
9. October 19, 2026: A detention hearing is set before Judge Tse.

FBI Director Kash Patel framed the alleged goal as speech about the company’s technology, not a download from a locked cluster.

Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology.

Kash Patel, FBI Director, Justice Department statement

U.S. Attorney Craig Missakian called the arrest a national security matter for the office that covers Silicon Valley. Scott Schelble, special agent in charge of FBI San Francisco, said any attempt to take protected information from U.S. super intelligence companies threatens both innovation and the security interests those advances support. Director of National Intelligence Jay Clayton said the intelligence community remains committed to safeguarding American intellectual property from foreign threats. None of those statements names a foreign service, a competitor, or a person who was supposed to receive a recording.

Cameras Caught Him Checking the Television

Liang listed 10 dates in September when CCTV showed Alfozan near Conference Room 1. Some stops last a minute. Several last into the evening.

THE SEPTEMBER VISITS ON CAMERA

September 28 is the install window. September 29 is a two-minute pass the day before the sweep. On October 5, after the board had already been pulled, Alfozan walked into the room and appeared to look behind the television. The complaint includes that still.

That same day he left a bag unattended in a different room in the building. OpenAI security opened it and found his wallet, his ID, and another recording device similar to the one from the television. The public filing describes that second unit in the singular.

OpenAI Used Its Models on the Forensic Image

OpenAI’s newsroom account posted the company’s account of the find on October 13. The post is the cleanest primary statement the firm has put on the record.

We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re…

— OpenAI Newsroom (@OpenAINewsroom) October 13, 2026

The wording does two jobs at once. It tells staff and customers that model weights, source code, and customer data do not appear to have left the building. It also tells the rest of the industry that OpenAI used its models “to understand the device and where it had come from,” then walked that trail to one employee. The models did not find a microphone in a toilet-paper wrap. A sweep team did. The models, the company says, helped make sense of copies of the stored data and of how the board had changed.

That public line landed, in the first hours, as a product demonstration as much as a case update. The analog part of the story is less convenient. A calendar agent answered questions about executive rooms. A $13.99 board with a microphone fit behind a conference television. Encryption hid whatever sat on the card. The attack path was a badge, a USB port, and speech in a room that still had no camera when the recorder went in.

William Pernik, a lawyer for Alfozan, said his client is presumed innocent and cautioned against “jumping to conclusions at this very early stage of the case when very little information is known,” or seeking to “politicize” a prosecution based on nationality.

Jumping to conclusions at this very early stage of the case when very little information is known.

William Pernik, attorney for Abdulrahman Alfozan

WHAT WE KNOW

• The hardware: A Seeed XIAO ESP32-S3 Sense was found wrapped in toilet paper in a USB port on an executive conference television on or about September 30.
• The charge: One count of using or endeavoring to use a device to intercept oral communications, with a detention hearing set for October 19.
• The company’s review: OpenAI says it has no indications Alfozan inappropriately accessed or exfiltrated model weights, source code, or customer data.

WHAT IS UNCONFIRMED

• A handler: The complaint does not name a foreign government, a rival lab, or any other intended recipient of the recordings.
• Playable audio: Investigators have not said they decrypted the microSD card, so it is not public whether the two days in the wall captured usable speech.
• Motive: Patel described an aim to capture sensitive communications about the company’s technology. Prosecutors have not filled in why, or for whom.

Alfozan remains in federal custody. Judge Tse will hear the detention question on October 19.