On October 13, 2026, the Department of Justice announced that Abdulrahman Alfozan, 35, a Saudi national who had worked as an engineer at OpenAI since July 2025, was arrested and charged with using or attempting to use a device to intercept oral communications. Prosecutors allege he hid a covert recording device inside his employer’s executive conference room in San Francisco. He was arrested on October 9 and made his initial appearance in federal court on October 13.
No hacking, no stolen files, no malware. This case is about an employee with a badge, building access, and company tools, and how quickly the security team connected the dots once the device was found.
What Happened
According to the Department of Justice:
- On or about September 28, a recording device was concealed in a USB port on the back of a television in an executive conference room. It was wrapped in toilet paper, and its contents were encrypted. OpenAI found it on or about September 30.
- Building CCTV showed Alfozan near the conference room on multiple dates, even though he had no authority to access it.
- Before September 28, Alfozan allegedly used a productivity tool to make multiple inquiries about OpenAI’s building addresses, meeting rooms, room capacities, calendars, and executive locations.
- A chatbot account linked to his spouse, which shared identifiers with his own account, allegedly submitted prompts between September 24 and September 30 about building, customizing, installing, concealing, and testing audio recording devices. Other prompts referenced the specific device.
- On October 5, he allegedly looked behind the television in the same conference room. That day he also left a bag in another room. Security found a second, similar recording device inside, along with his wallet and ID.
- The charge carries up to 5 years in prison, a $250,000 fine, and 3 years of supervised release. The FBI is investigating, and the U.S. Attorney’s Office for the Northern District of California is prosecuting with support from the National Security Division’s Counterintelligence and Export Control Section.
FBI Director Kash Patel said, “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security.” The charge is an allegation, and Alfozan is presumed innocent unless and until proven guilty.
Lessons for Every Insider Threat Program
1. Insider threats are physical, not just digital. Data loss prevention and network monitoring would not have seen a device hidden behind a television. Programs need technical surveillance countermeasures (TSCM) sweeps of executive and sensitive meeting spaces, and facility staff trained to report anything plugged in that does not belong.
2. Correlate access with authority. Alfozan allegedly appeared near a room he had no authority to enter, more than once. Badge logs and CCTV are only useful if someone compares them against who is supposed to be there. Repeated presence near executive areas by someone with no business reason is an indicator worth flagging.
3. Watch for reconnaissance in internal tools. Queries about building addresses, room capacities, calendars, and where executives will be are the planning stage of an attack. User activity monitoring of enterprise and productivity tools should treat unusual interest in leadership schedules and locations as a risk signal, especially when it falls outside a person’s job.
4. Pre-incident research leaves a trail. According to prosecutors, the prompts about building and concealing recording devices came days before and during the period the first device was in place. Organizations that log and review activity on approved AI tools gain visibility into intent, not just action, as long as that monitoring is lawful, disclosed, and governed by policy.
5. Have a response playbook ready before the discovery. Finding the first device was not the end. A second device turned up five days later. When security finds evidence of an insider, it needs a plan to preserve evidence, increase monitoring, coordinate with legal, and refer to law enforcement quickly without tipping off the subject.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
We help organizations:
- Build or assess insider threat programs that combine physical security, access data, and user activity monitoring into one picture
- Identify reconnaissance and pre-attack behavior across enterprise tools, including AI platforms
- Develop response playbooks and referral processes so a discovery becomes a case, quickly and cleanly
To talk with our team, contact info@tmpcinc.com or 813.524.6935.