Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ

The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.

A US judge agreed to detain a former OpenAI employee who allegedly recorded corporate conversations after prosecutors argued he was a flight risk and presented evidence of extensive communications with a member of the Saudi royal family. The incident is a modern twist on the so-called "evil maid" attack, where someone gains unauthorized physical access to an unattended device in order to steal information or plant malware.

On Oct. 9, US authorities arrested and charged Abdulrahman Alfozan, 35, with illegally intercepting oral communications. Prosecutors allege Alfozan placed one recording device in an executive conference room at one of the company's San Francisco offices, and that OpenAI security personnel later found a second, similar device in a bag he left unattended at the company. He joined OpenAI as an engineer in July 2025 and was fired from the company following his arrest on Oct. 9 of this year.

According to the criminal complaint filed Oct. 8, the executive conference room device was installed at least as early as Sept. 28, and recording continued for an indeterminate amount of time, at least through Oct. 5.

US Prosecutors Cite Saudi Arabia Ties in Detention Bid

On Oct. 18, the US government requested a US court detain Alfozan, a Saudi Arabian national, under concerns he may be a flight risk. According to a filing, US prosecutors claimed Alfozan has "considerable resources and ties to Saudi Arabia." Furthermore, the prosecutors argued that he was days away from departing the US for Saudi Arabia when he was arrested, based on plans he made for parental leave, documents involving travel to Riyadh via a one-way plane ticket, and the fact that Alfozan's wife and infant son left for Saudi Arabia shortly prior to his arrest.

Moreover, prosecutors claim he was in frequent communication with an unidentified member of the Saudi Royal Family throughout 2025 and 2026, including as recently as Oct. 5. The royal family member allegedly told Alfozan that Saudi Arabia was launching an AI initiative and wanted Alfozan to join it.

"In May 2026, the individual told the defendant, 'Saudi needs you more then [sic] the US!' to which the defendant responded '100,' indicating he agreed," the document read. "The individual repeatedly tried to recruit the defendant and asked when he planned to leave OpenAI. At the time, the defendant said he wouldn't leave until his stock vested."

US prosecutors also claim the defendant was researching other Saudi Arabian opportunities prior to his arrest, as well as apparently searching through internal corporate data for OpenAI interest in Saudi Arabia. A federal magistrate with the US District Court of the Northern District of California, San Francisco Division, approved the prosecutors' request on Monday to retain him in custody as the trial proceeds.

The current criminal charge, a felony violation prohibiting the use of a device to intercept oral communications, carries a maximum penalty of five years in prison.

"In the days surrounding the time period that the device was installed, OpenAI executives met with government officials in that very room," the Oct. 18 filing read. "Defendant's conduct could pose a danger to the national security of the United States."

The Specter of AI Insider Threats

Insider threats like this aren't uncommon, but prosecutors' allegations that the engineer secretly recorded executive meetings while maintaining communications with a member of the Saudi royal family make the case a particularly unusual example, but perhaps not a surprising one. The AI race is a global one encompassing both public and private sector organizations. It stands to reason that there would be interest in trade secrets and IP belonging to frontier large language model (LLM) firms.

So it's predictable that, as the Wall Street Journal recently reported, that OpenAI was giving employees counterintelligence-style security training covering issues such as "honey pot" schemes, bribery, and eavesdropping, reportedly out of concern that foreign operatives could attempt to obtain AI secrets through spycraft. However, the company wasn't looking out for its physical footprint, apparently.

Mark Beccue, chief analyst at Omdia (also owned by Informa TechTarget), tells Dark Reading that companies like OpenAI, Anthropic, Mistral, Google, AWS, Microsoft, and others represent the "tip of the spear in AI's warp-speed innovation," and he wouldn't be surprised if more countries are attempting to recruit internal assets in a manner akin to what US prosecutors suggest Saudi Arabia may have tried to do with Alfozan.

"They are building and iterating the most advanced AI models, several steps ahead of open source models," he says. "All of these players, with the exception of Mistral, are US companies. Sovereign AI, the concept of home-grown AI innovation, has taken root across the globe and countries see model innovation as geo-politically strategic and key to economic growth."

OpenAI did not respond to Dark Reading's request for comment by press time.