FBI arrests OpenAI engineer for bugging exec conference room days before Saudi flight

The FBI arrested Abdulrahman Alfozan, an OpenAI engineering lead, on Oct. 9. The arrest came three days before he was set to board a one-way flight to Saudi Arabia via Istanbul, according to court documents reviewed by Fortune.

Alfozan is accused of planting a sophisticated recording device in a conference room at OpenAI's San Francisco offices. The device was plugged into a USB port on the back of a television and concealed by a small piece of toilet paper. OpenAI's technical surveillance countermeasures team discovered it on Sept. 30 during a sweep. The FBI says the device had advanced encryption, audio monitoring capabilities, and a data-transfer mechanism designed to evade detection. That conference room was routinely used for discussions of "highly confidential technical, commercial, and strategic information," including with government officials, covering proprietary research, product plans, business-development opportunities, and nonpublic information about OpenAI's technical progress, strategic decisions, and government engagements.

Alfozan, 35, is a Saudi citizen and has been a legal permanent resident of the United States since September 2020. He was educated in the U.S., graduating from MIT in 2016 and UC Berkeley in 2025. He spent five years at Meta before joining OpenAI in 2025, and his LinkedIn described him as an engineering lead working on OpenAI's Agents Platform. He is currently in federal custody and appeared in federal court this week. He faces a maximum sentence of five years in prison plus three years of supervised release if convicted.

OpenAI did not fire Alfozan immediately, and the FBI did not arrest him immediately. Instead, the company worked with the FBI to time his termination so the investigation would not be disrupted. Between Sept. 30 and Oct. 9, OpenAI restricted Alfozan's access to systems and parts of the office, suspended his network access, placed him on leave, and took his company-issued equipment. Yet the security breakdown continued: on Oct. 5, Alfozan allegedly entered the conference room again, checked behind the television for the device, and was captured on CCTV. He also left an unattended bag in a different room containing his wallet, identification, and another recording device.

The FBI says Alfozan consulted an unnamed chatbot associated with his spouse between Sept. 24 and Sept. 30 about building, installing, and encrypting audio recordings. He also used an internal productivity tool to inquire about OpenAI's building addresses, meeting rooms, capacities, calendars, and locations of leadership and external partner meetings. The FBI has not found evidence that any data leaked, and OpenAI stated on X that it has "no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data." However, the investigation remains ongoing.

OpenAI is using the incident to showcase how its own technology can help combat such threats. The company said it used its models "to understand the device" and identify which employee had planted it. FBI Director Kash Patel called the incident a matter of national security, saying, "Protecting American SI [Super Intelligence] is essential to safeguarding our nation's economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities."

For decision-makers, this case is a stark reminder that insider threats extend beyond cyber breaches into physical espionage. AI companies now hold some of the world's most valuable trade secrets, and the FBI has explicitly elevated the protection of that technology to a counterintelligence mission. The episode also underscores the importance of coordinated response: OpenAI's decision to delay termination and restrict access while working with federal investigators offers a template for balancing legal obligations with operational security.

For peers in AI and other deep-tech sectors, the stakes are clear. A single employee with physical access can compromise the most sensitive conversations in a company, and the timeline here shows how quickly a threat can escalate. The case will likely accelerate investments in technical surveillance sweeps, stricter access controls, and insider-threat programs across the industry, as boards reassess who can enter the rooms where the future is being planned.