OpenAI says its own models helped trace a hidden office bug

The bug was wrapped in toilet paper and plugged into a USB port behind a television in an executive conference room, and OpenAI says its own models helped work out what it was and who put it there. In a statement on Twitter, the company said it identified the employee who had planted it a few days earlier and referred the matter to the FBI.

Alfozan joined OpenAI as an engineer in July 2025, and the company says he worked on the product team. A LinkedIn profile matching his name lists him as engineering lead on OpenAI's AI agents platform. Before that, the profile says, he was a founding engineer at Nash, an AI infrastructure company for logistics, and a senior systems engineer at Meta from 2017 to 2022. A YouTube video last month described him as the only Saudi employee at OpenAI.

The recorder was installed around September 28 and found two days later

According to the complaint, OpenAI staff found the device on September 30, plugged into a USB port behind a television in an executive conference room at the company's San Francisco offices. OpenAI says its technical surveillance countermeasures team found it during a sweep of the room. The company determined it had been installed around September 28, and its contents were encrypted.

Prosecutors say the room was frequently used for discussions involving confidential research, product plans, business strategy, government engagements and commercial relationships. Surveillance footage allegedly showed Alfozan near the room on multiple occasions before the discovery, even though he had no authorization to enter it or attend meetings there.

On October 5, security found a second recorder in his unattended bag

On October 5, the complaint says, Alfozan entered the conference room and appeared to look behind the television where the recorder had been. According to TechCrunch, OpenAI had placed a camera there, and it allegedly caught him. Prosecutors released an image of the moment. The same day, security staff opened a bag he had left unattended in another room and found his wallet, his ID and a second, similar recording device.

OpenAI says it has evidence that he intended to place more devices in sensitive spaces. Between September 30 and the arrest, it gradually restricted his access to systems and spaces, then suspended his physical and network access, put him on leave and secured his company equipment. The company coordinated the timing of his firing with the FBI and fired him on Friday, the day of his arrest.

A chatbot account tied to his spouse asked about the device's MAC address

Before the installation, prosecutors allege, Alfozan used a productivity tool to ask about OpenAI's building addresses, meeting rooms, room capacities and calendars, and about where leadership and outside partners were meeting.

The second trail runs through a chatbot account associated with his spouse, which shared identifiers with his own. Between September 24 and September 30, it submitted prompts about building, installing, hiding and remotely accessing a recording device. These included how to "build a continuous audio recorder" and "encrypt the SD card", as well as adding Wi-Fi and listening remotely. On September 27 and 28, it asked about the specific device that was later found, including its unique MAC address.

OpenAI says its models analyzed forensic images of the device's storage

OpenAI describes the recorder as sophisticated and designed to evade detection. It says the device had advanced encryption, audio monitoring capabilities and a way of transferring data that was meant to avoid monitoring. TechCrunch notes it is unclear how technically different it is from other recording devices. OpenAI says investigators used its models to analyze forensic images of the device's storage and assess changes in the underlying data.

A forensic image is an exact copy of a storage card, made so analysts can work on the copy and leave the original untouched. Assessing changes in the data means looking at what was written, removed or overwritten, much like checking which pages of a notebook were torn out or rewritten. OpenAI presents the case as an example of AI helping to counter sophisticated threats, including insider risks.

Prosecutors treat the case as a national security matter

"For us it is a matter of national security," U.S. Attorney Craig Missakian said. FBI Director Kash Patel said protecting U.S. AI innovation is among the bureau's highest counterintelligence priorities. According to TechCrunch, he described the scheme as aimed at capturing "sensitive communications about the company's super intelligence technology". The Director of National Intelligence linked the case to the "super intelligence race".

Scott Schelble, special agent in charge of the FBI's San Francisco field office, said the agency is committed to protecting sensitive research and proprietary technology. The case is being prosecuted by the National Security, Cyber & Special Prosecutions Section of the U.S. Attorney's Office for the Northern District of California.

The complaint shows that a recorder was planted, but not what it captured or who the recordings were for. TechCrunch says the purpose is not clear. In our view, OpenAI's claim that its models solved the case deserves the most caution: the evidence described so far mostly comes from ordinary security work, such as a room sweep, a camera and a bag left behind, and OpenAI does not say what the models found that investigators would otherwise have missed.

What the October 19 hearing decides

A detention hearing before U.S. Magistrate Judge Alex G. Tse is set for October 19. It will decide whether Alfozan stays in custody while the case goes on. He has been charged, not convicted. If convicted, he faces up to five years in prison, a $250,000 fine and three years of supervised release. OpenAI says the FBI investigation is ongoing and that it will keep supporting it.