On October 13, 2026, the Department of Justice announced charges against Abdulrahman Alfozan, 35, a Saudi Arabian national who had worked as an engineer at OpenAI since July 2025. He was arrested on October 9 and made his initial appearance in federal court on October 13. He is charged with using or endeavoring to use a device to intercept oral communications and faces a maximum of five years in prison if convicted. These are allegations in a criminal complaint; he has not been convicted.
This case is not about a large file download or a stolen laptop. It is about an employee who allegedly used ordinary building access to listen in on conversations he had no business hearing. That makes it a useful test for any insider threat program.
What Happened
According to the Department of Justice:
- Alfozan had no authority to access or attend meetings in an executive conference room where discussions often covered confidential technical, commercial, and strategic information.
- On or about September 30, OpenAI personnel found a recording device hidden in toilet paper and plugged into a USB port on the back of a television in that executive conference room in a San Francisco building. OpenAI determined it was installed around September 28, and its contents were encrypted.
- CCTV footage allegedly shows Alfozan near the conference room on multiple dates before the device was found.
- He allegedly used a productivity tool to ask about OpenAI building addresses, meeting rooms, room capacities, calendars, and executive locations.
- A chatbot account tied to his spouse, which allegedly shared identifiers with his own account, submitted prompts from September 24 to 30 about building, installing, and testing audio recording devices. Prompts on September 27 and 28 allegedly referenced the first device’s custom header and MAC address.
- On October 5, he allegedly entered the conference room and appeared to look behind the television. The same day, he allegedly left a bag unattended in another room. OpenAI security opened it and found a second, similar recording device along with his wallet and ID.
- The FBI is investigating. The case is being prosecuted by the U.S. Attorney’s Office for the Northern District of California with the National Security Division’s Counterintelligence and Export Control Section.
Lessons for Every Insider Threat Program
- Physical access is part of the insider threat picture. Many programs focus almost entirely on network data. Here, the alleged collection tool was a small device in a USB port on a conference room TV. Restrict access to rooms where leadership discusses strategy, review who badges in, disable or lock unused ports on room AV equipment, and sweep sensitive spaces on a schedule.
- Watch for reconnaissance, not just exfiltration. Questions about meeting rooms, calendars, and where executives are located are not unusual on their own. From an engineer with no reason to need them, they can be early warning signs. Monitoring of internal tools, compared against a person’s role, can surface this kind of research before anything leaves the building.
- Connect the signals across silos. CCTV footage, tool queries, room access, and a found device each look small in isolation. An insider threat hub that brings security, IT, HR, and legal together is how those fragments become a pattern fast enough to act on.
- Train people to report and preserve. In this case, company personnel found the first device and company security found the second. Make sure facilities staff, executive assistants, and employees know what an out-of-place device looks like, who to call, and how to document it without destroying evidence. Have a playbook ready for when law enforcement needs to be involved.
- Assume your leadership conversations are a target. DOJ tied this case to National Security Presidential Memorandum 11, which supports American leadership in advanced AI. U.S. Attorney Craig H. Missakian said, “For us it is a matter of national security.” Companies building technology for defense and intelligence missions should plan as if their strategy meetings are a collection target, because they may be.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- Insider threat program assessments and build-outs that cover physical and behavioral indicators, not just technical ones
- User activity monitoring (UAM) operations and analysis that correlate signals across security, IT, and HR
- Insider threat awareness training for employees, managers, and facilities staff
To talk with our team, contact info@tmpcinc.com or 813.524.6935.