Prosecutors say chatbot prompts helped plan the OpenAI bug

According to a federal complaint described by the Justice Department, someone wrapped a recording device in toilet paper and plugged it into a USB port on the back of a TV in an OpenAI executive conference room. Prosecutors cite chatbot prompts about "build[ing] a continuous audio recorder" in their case against OpenAI engineer Abdulrahman Alfozan, 35, a Saudi national arrested on Oct. 9.

If you have not been following, here is who he is. According to the Justice Department, Alfozan had worked at OpenAI as an engineer since July 2025, while SFGate puts his start in August 2025. Reuters says he has been a US legal permanent resident since September 2020. Reuters, in a report carried by Yahoo News, also noted that OpenAI had fired three researchers the previous Friday over violations of policies on handling sensitive information.

The recorder sat behind a TV in an executive room for two days

Per the complaint, OpenAI personnel found the device, labelled Recording Device 1, on or about Sept. 30, inserted into a USB port on the back of a television in an executive conference room in one of the company's San Francisco buildings. OpenAI determined it had been installed on or about Sept. 28 and that its contents were encrypted. According to Yahoo News, it was a thumb-sized unit with a microphone that could connect to a camera.

The room mattered. Prosecutors say meetings there often covered confidential technical, commercial and strategic material: proprietary research, product plans, business-development opportunities, and nonpublic information about OpenAI's technical progress, priorities, government engagements and commercial relationships. Alfozan had no authority to enter it or join its meetings, yet CCTV footage showed him near the room on multiple dates before the device turned up.

A spouse-linked chatbot account asked how to build, hide and encrypt a recorder

Before Sept. 28, the complaint says, Alfozan used a productivity tool to ask about OpenAI's building addresses, meeting rooms, room capacities and calendars, "leadership and exec" locations, and external partner meetings. Those queries ran for about a month through Sept. 16.

An account associated with his spouse, which shared identifiers and attributes with Alfozan's own account, sent prompts between Sept. 24 and Sept. 30 on building, customizing, installing, audio recording, testing, obfuscating and remotely accessing a device. The complaint lists inquiries about "customiz[ing] Wi-Fi . . . connectivity," "improv[ing] audio and live listening" and "encrypt[ing] the SD card." Between Sept. 27 and Sept. 28, the same account asked about Recording Device 1, including its custom header and unique MAC address.

On Oct. 5, a look behind the TV and a second device in his bag

The complaint says that on Oct. 5 Alfozan entered the executive conference room and appeared to look behind the television where the device had been. The same day he left a bag unattended in a different room. OpenAI security opened it and found his wallet and ID along with Recording Device 2, similar to the first.

He was arrested on Friday, Oct. 9, and stayed in custody until his first federal court appearance on Tuesday, The Verge reports. The charge is using or endeavoring to use a device to intercept oral communications, which carries up to 5 years in prison, a $250,000 fine and 3 years of supervised release if he is convicted. OpenAI says it fired him.

Assistant U.S. Attorney Nicolas Parker is prosecuting, assisted by Trial Attorney Kate Tagert of the National Security Division, and the department ties the case to National Security Presidential Memorandum 11. According to CBS News, his attorney William Pernik said Alfozan is presumed innocent and warned against politicizing the case based on factors like nationality.

OpenAI says its own models traced the device to one employee

In its statement, OpenAI says it used its models "to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier." It did not explain how. The company also says it has evidence the employee intended to place more recording devices in sensitive areas of its offices.

The MAC address detail in the complaint shows what such a trail can look like. A MAC address is a hardware identifier a device uses on a local network, something like a licence plate for one gadget. A prompt that names a unique MAC address is about one particular device, and prosecutors say the spouse-linked account named the address of Recording Device 1.

The gap at the centre is what the device actually heard. Its storage was encrypted, the complaint describes no recordings, and according to Newsweek prosecutors have not named a recipient, a foreign government or a motive. Oddly, OpenAI credits its models with the identification but does not say what they did, which leaves the AI part of this story the least documented one.

What the FBI still has to establish

Alfozan has been charged, not convicted, and the inputs give no date for the next hearing. The FBI says its investigation continues, and OpenAI says it will keep supporting it. The open questions are whether the encrypted contents of either device can be read, what Recording Device 2 was meant for, and whether investigators will ever say who the recordings were for. No timeline for any of those answers has been given.