On Sept. 30, a security team at OpenAI swept an executive conference room in one of the company’s San Francisco buildings and found a thumb-sized recording device wrapped in toilet paper, plugged into a USB port on the back of the television. Its storage was encrypted. Ten days later the FBI arrested the engineer prosecutors say put it there.
Abdulrahman Alfozan, 35, a Saudi national who had worked at OpenAI since July 2025, was arrested Oct. 9 and made his first court appearance Tuesday, the Justice Department said. He remains in custody, the San Francisco Chronicle and The San Francisco Standard reported. Senior officials have described the case as a national security matter. The FBI director spoke of OpenAI’s “super intelligence technology,” and the director of national intelligence of “foreign threats.” The charge filed so far is narrower, a wiretap offense, and the public record does not say whom, if anyone, the recordings were meant for.
The complaint’s timeline
The Justice Department’s account of the criminal complaint, unsealed Tuesday, lays out the sequence below. Every entry is an allegation. It was not immediately clear who his lawyer was, Reuters reported.
| Date | What prosecutors allege |
|---|---|
| Before Sept. 28 | Alfozan uses a workplace productivity tool to ask about OpenAI’s building addresses, meeting rooms and calendars, and where “leadership and exec” and outside partner meetings take place. |
| Sept. 24 to 30 | A chatbot account tied to his spouse submits prompts on building, hiding, encrypting and remotely accessing an audio recorder. |
| Sept. 27 to 28 | The same account asks about the specific device later found, including its unique MAC address. |
| About Sept. 28 | The device is installed behind the conference room TV. |
| Sept. 30 | OpenAI personnel find it. |
| Oct. 5 | Security cameras show Alfozan entering the room and looking behind the TV. The same day, a bag he left unattended in another room turns up holding his wallet, his ID and a second, similar device. |
| Oct. 9 | FBI arrest. OpenAI fires him the same day. |
He had no authority to enter the room or join meetings there, according to the complaint. Those meetings, the Justice Department said, often covered proprietary research, product plans, business deals and OpenAI’s “government engagements.”
Two details come from the FBI affidavit as described by The Standard and haven’t appeared in the department’s own release. When Alfozan collected the bag on Oct. 6, the device was gone. He then reported cash, AirPods and other items stolen without mentioning a recorder, the affidavit says. Court filings also identify the device as a Seeed XIAO ESP32-S3 Sense, a hobbyist development board with a microphone, a detachable camera and a microSD slot, The Standard reported.
A trail through two chatbot accounts
The case leans heavily on AI logs. According to the department, the spouse’s chatbot account shared “multiple identifiers and attributes” with Alfozan’s own. Its prompts included inquiries about “build[ing] a continuous audio recorder” and “encrypt[ing] the SD card.” The release doesn’t accuse his wife of any wrongdoing.
OpenAI said on X that it used its own models to work out what the device was and to trace it to the employee who planted it, Reuters and BleepingComputer reported. The company said it had evidence he meant to plant more devices in sensitive areas. It also said it had found no sign he accessed or took model weights, source code or customer data. In the same statement, according to The Standard and the Chronicle, OpenAI said it narrowed his access gradually after Sept. 30 and timed his firing with the FBI to avoid disrupting the investigation.
Five years under the wiretap law
The charge is using or trying to use a device to intercept oral communications. That language matches a provision of the federal Wiretap Act, 18 U.S.C. § 2511(1)(b), and like that provision it carries up to five years in prison. Prosecutors have not charged espionage, theft of trade secrets or acting as an agent of a foreign government. Because the device’s contents were encrypted, the complaint as described doesn’t say what, if anything, it captured.
The officials quoted in the release went further than the charge. FBI Director Kash Patel called protecting American “SI innovation” one of the bureau’s “highest counterintelligence priorities.” Director of National Intelligence Jay Clayton said the case showed why winning “the global super intelligence race” is a national security “prerogative” and credited President Trump’s Super Intelligence Force, the AI task force Clayton now leads. Attorney General Todd Blanche wrote on X that the “alleged attempt by a Saudi national” was taken extremely seriously, Fox Business reported. The Saudi embassy did not immediately respond to Reuters.
The prosecution team matches that framing. An assistant U.S. attorney in San Francisco is prosecuting, with help from a trial attorney in the National Security Division’s Counterintelligence and Export Control Section. The release says the case supports National Security Presidential Memorandum 11, which it describes as “designed to support American superiority in super intelligence technology.”
The memo itself, which Trump signed June 5, is narrower than that description. Its title is “Artificial Intelligence in the National Security Enterprise,” and it governs how the military and intelligence agencies buy and use AI. Its closest provision orders the intelligence director and the Pentagon to draft a strategy for securing the confidentiality of America’s most critical AI systems. The phrase “super intelligence” doesn’t appear in it.
What the filings leave open
The FBI is still investigating. The public record doesn’t say why Alfozan allegedly wanted the recordings, whether anyone directed him or whether the encrypted storage has been opened. A detention hearing is set for Oct. 19, the Chronicle reported.
The arrest came days after OpenAI said it had fired three researchers for breaking its rules on handling sensitive information, Reuters and the Chronicle reported. The Justice Department’s release doesn’t mention that case.
Primary source: Justice Department, “Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI” (Oct. 13, 2026).
For the task force Clayton runs, see our earlier piece, Trump Puts the Intelligence Chief in Charge of AI Policy.
The Recorder Behind the TV in OpenAI’s Executive Conference Room
Sources
- U.S. Department of Justice, Office of Public Affairs, press release 26-1173 (Oct. 13, 2026). Used for: the charge, arrest and court dates, the complaint’s allegations and timeline, the officials’ statements, the prosecutors, NSPM-11, the penalty.
- National Security Presidential Memorandum 11, “Artificial Intelligence in the National Security Enterprise” (June 5, 2026). Used for: the memo’s title, date, scope and AI security provision.
- 18 U.S.C. § 2511, via Cornell Law School’s Legal Information Institute. Used for: the intercept offense and its five-year maximum.
- George Kelly and Michael McLaughlin, The San Francisco Standard (Oct. 13, 2026; updated Oct. 14). Used for: custody status, the affidavit’s account of Oct. 6, the device model, OpenAI’s account of his access and firing.
- Aidin Vaziri, San Francisco Chronicle (Oct. 13, 2026). Used for: custody status, OpenAI’s statements, the Oct. 19 detention hearing, the three researchers’ firing.
- Reuters, via CBC News (Oct. 13, 2026). Used for: OpenAI’s X statement, the lawyer and Saudi embassy queries, the three researchers’ firing.
- BleepingComputer (Oct. 13, 2026). Used for: OpenAI’s X statement on using its models.
- Fox Business (Oct. 13, 2026). Used for: Attorney General Blanche’s post on X.