FBI arrests OpenAI engineer over hidden microphone in executive room

United States federal agents have arrested an OpenAI software engineer, charging him with planting a hidden audio recording device inside an executive boardroom at the company's San Francisco headquarters.

Abdulrahman Alfozan, a 35-year-old Saudi citizen who joined OpenAI in July 2025, made his first federal court appearance on 13 October 2026. The United States Department of Justice charged him with using or trying to use a device to intercept oral communications.

OpenAI staff first detected the encrypted listening unit on 30 September 2026. According to court filings, the device was wrapped in paper and plugged into a USB port on the rear of a television monitor inside the private conference room. Investigators allege the room was regularly used by senior staff to discuss confidential commercial plans, proprietary research, and technical roadmaps. Security footage showed Alfozan entering areas near the boardroom on several dates, despite having no authorisation to take part in those executive sessions.

OpenAI stated that it reported the matter to the Federal Bureau of Investigation, sacked the engineer, and found no evidence that model weights, source code, or customer files were copied or removed.

What this means for Australian businesses

While corporate espionage headlines usually focus on the world's largest tech developers, the incident points to practical security lessons for Australian firms handling proprietary data and client records.

• Check physical access controls: Many organisations audit network passwords and firewalls, yet leave meeting rooms and office hardware completely open. Simple hardware audits of communal displays, meeting rooms, and shared desks help stop unauthorised hardware being plugged into company infrastructure.
• Apply the principle of least privilege: Limit staff and contractor access to sensitive operational files, strategic discussions, and private client material. Workers should only have entry to the tools and spaces strictly required for their daily duties.
• Review supplier and hosting assurances: Australian businesses relying on cloud AI providers need to check how suppliers isolate their data. Ensure contracts make clear whether prompts and business records are stored securely, who has access behind the scenes, and how insider threats are monitored.
• Set clear workplace device rules: Keep personal storage devices, untracked USB drives, and unapproved recording tools off business networks to reduce the chance of internal data breaches.