FBI Arrests OpenAI Engineer Accused of Hiding Bug in Toilet Paper Inside Secure Conference Room
Abdulrahman Alfozan allegedly planted the device in a restricted meeting room and was caught on camera trying to retrieve it days later.
OpenAI's physical security team found something odd stuck to the back of a television in one of its most restricted conference rooms: a USB recording device, wrapped in toilet paper to keep it out of sight. By the time anyone noticed, it had likely been there for two days.
The FBI says it knows who put it there. In a press release announcing an arrest on Tuesday, the agency identified the suspect as Abdulrahman Alfozan, a 35-year-old OpenAI engineer from Saudi Arabia who became a permanent US legal resident in 2020. He'd worked at the company for more than a year. Federal investigators allege he used the device to spy on conversations in a conference room where OpenAI leadership discussed confidential material, including technical progress, government engagements, and commercial partnerships. Access to that room is limited to employees with special clearance.
The FBI says chatbot logs and CCTV footage point to Alfozan as the person behind it, and that the attempt risked exposing trade secrets in a way serious enough to raise national security concerns.
According to the FBI's account, the device was likely planted on September 28. OpenAI discovered it two days later, on September 30, and determined almost immediately that its contents were encrypted, locking investigators out of whatever it had recorded. Rather than confront the situation head-on, the company and the FBI apparently decided to wait and watch. On October 5, OpenAI quietly installed a camera in the same conference room. That same day, the footage allegedly captured Alfozan returning to retrieve the device.
That detail is what turns this from an internal security incident into a criminal case with real evidence behind it. Catching someone trying to recover a hidden bug is a far stronger basis for prosecution than finding the device itself, which on its own wouldn't prove who planted it or why.
Alfozan now faces charges tied to laws against unlawful recordings. If convicted, he could face up to five years in prison and a $250,000 fine, per the FBI.
What stands out almost as much as the device itself is how OpenAI handled the discovery. Rather than firing Alfozan the moment the bug turned up, or pulling his access all at once, the company gradually cut him off from internal systems while it worked with the FBI to analyze what the device had captured. That kind of restraint is deliberate: moving too fast can tip off a suspect, destroy evidence, or blow an active investigation. OpenAI waited until it had built a strong enough case, then fired Alfozan on Friday, timed to coincide with the FBI's arrest.
The specifics here read almost like a low-budget spy thriller, but the stakes are not small. OpenAI sits at the center of the US AI industry, works closely with government agencies, and holds technical and strategic information that rival companies, foreign governments, and plenty of opportunists would like to get their hands on. A device slipped behind a conference room TV, however crude the concealment, is exactly the kind of low-tech intrusion that security teams at a company like this are supposed to be built to catch quickly. The fact that it sat undetected for two days, and might have gone unnoticed longer without a routine sweep, is the part worth sitting with.
It also underscores something that gets lost in conversations about AI security, which tend to focus on model weights, cloud infrastructure, and cyberattacks. The leak OpenAI caught here wasn't digital. It was a hidden microphone, planted by someone with legitimate badge access, exploiting the oldest vulnerability in any secure facility: a person already on the inside.
The case is now in the hands of federal prosecutors, and the details that surface at trial, including what exactly the device recorded and what Alfozan allegedly intended to do with it, will likely shape how OpenAI and other major AI labs think about physical security going forward. For an industry that spends enormous effort guarding its code and its servers, a story like this is a reminder that a conference room, a television, and a roll of toilet paper can be just as consequential a vulnerability.
