Former OpenAI Engineer Arrested for Planting Hidden Recorder in San Francisco Office

U.S. authorities detained former OpenAI engineer Abdulrahman Alfozan, 35, on Oct. 9, 2026 after prosecutors said he placed a covert recorder in an executive conference room at the company’s San Francisco office (The Hacker News).

The criminal complaint, filed Oct. 8, alleges the device was installed as early as Sept. 28 and kept recording through Oct. 5; investigators later found a second similar device in a bag he left unattended (Dark Reading).

Alfozan, a Saudi national hired as an engineering lead in July 2025, was fired after his arrest and now faces a felony charge for using a device to intercept oral communications, a crime punishable by up to five years in prison.

Prosecutors said he posed a flight risk, citing his “considerable resources and ties to Saudi Arabia,” planned travel to Riyadh, and recent messages with an unidentified Saudi royal who allegedly recruited him for a Saudi AI initiative.

A Northern District of California court approved his continued detention, noting frequent contact with the royal family member throughout 2025 and 2026, including a May 2026 conversation in which the individual told him, “Saudi needs you more then [sic] the US!” and Alfozan replied affirmatively.

OpenAI’s official X post confirmed the discovery of a sophisticated recording device, said the company used its models to trace the device to a specific employee, and reported the incident to the FBI (OpenAI Newsroom on X).

The case mirrors a classic “evil maid” attack, where physical access enables surveillance hardware, underscoring the need for tighter insider‑threat controls and continuous physical‑security monitoring in AI research labs.

The case suggests that insider threats remain a potent risk for AI firms, especially when employees have external affiliations that could motivate espionage. The alleged link to a Saudi royal family member points to state interest in AI capabilities, while the use of hidden audio devices highlights gaps in physical security that can be exploited despite digital safeguards. Organizations should reinforce access controls, conduct regular device sweeps, and monitor employee communications for signs of external recruitment.

Spotted an error? See our corrections policy or email editorial@lordofclaude.com.