Federal prosecutors have charged a Saudi national who worked as an engineer at OpenAI with secretly planting a recording device in one of the company's California offices.
Abdulrahman Alfozan, an engineer at the firm since July 2025, is charged with using or endeavouring to use a device to intercept oral communications. OpenAI says he has been fired.
Where it was, and how it was found
The device was wrapped in toilet paper and inserted into a USB port on the back of a television in an executive conference room at the San Francisco office. It was encrypted.
Prosecutors say it was installed on 28 September and found by employees on 30 September, two days later. On 5 October the suspect allegedly returned to inspect it, which CCTV images released by prosecutors appear to show.
OpenAI says it alerted the FBI, and that it used its own AI models "to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier".
The detail that makes this a different kind of story
According to the FBI, the suspect used a "productivity tool" and a "chatbot" to research sensitive locations inside OpenAI and how to place audio equipment covertly.
Prosecutors list the alleged prompts: building, customising, installing, testing, obfuscating and remotely accessing a device. Among them, requests to help "build a continuous audio recorder", "customize Wi-Fi connectivity", "improve audio and live listening" and "encrypt the SD card".
So on the available account, an AI assistant helped plan the operation and AI models helped unravel it, inside the same company. FBI Director Kash Patel said the alleged goal was to capture information about OpenAI's AI product.
OpenAI says it has no indication that source code, model weights or customer data were improperly accessed or taken.
What it means in Bangladesh
The glamorous reading of this is corporate espionage at a frontier AI lab. The useful reading is duller and transfers directly: the attack was physical, the access was legitimate, and the device cost very little.
Most security spending in Bangladeshi offices goes on the network — firewalls, antivirus, VPNs. Almost none goes on the question this case turns on, which is who can be alone in a meeting room with the television. A USB port on the back of a display in a conference room is not monitored anywhere, and a staff member walking into a room they are entitled to enter triggers nothing.
Two things follow that cost nothing to adopt. Rooms where commercially sensitive conversations happen should have their ports and cabling checked on a schedule, by someone who knows what belongs there — the device here was found by employees, not by a system. And offboarding should include physical access, not only accounts: the common failure in this country is a resigned employee whose office key and building pass are collected weeks after their email is closed.
On the other direction of the same problem, where the attacker is remote and impersonating someone senior, see the impersonation of an Anthropic executive.
Source: BBC News, from the federal complaint and statements by OpenAI and the FBI.
