A bug was unexpectedly found in OpenAI's executive conference room, and a 35-year-old engineer involved in the case was reported by AI and turned over to the FBI.
A real-life Mission: Impossible scene has unfolded at OpenAI's San Francisco headquarters!
Just now, OpenAI publicly disclosed a bizarre office eavesdropping case.
Behind the TV in its executive conference room, an encrypted audio recording device was secretly plugged in by an unauthorized party.
And it was none other than OpenAI's own AI model that helped the company follow the clues and track down the insider.
As the U.S. Department of Justice released the federal criminal complaint on the same day, the most dramatic part of the entire case came to light.
It turns out that AI was not only used by the investigation team in this cat-and-mouse game, the person who installed the bug also used AI as a consultant.
The complaint reveals that before the recording device was placed in the conference room, a chatbot account linked to the involved employee kept asking AI for guidance on how to assemble, hide, and remotely access the recording device for days in a row.
Even the unique hardware identifier of the discovered device appeared in the query records.
The official case briefing released by the Office of Public Affairs of the U.S. Department of Justice
While one party consulted AI about how to conduct covert recording, OpenAI deployed its own large model to help trace the source of the device, before FBI agents carried out the arrest.
The security offense and defense among Silicon Valley AI giants has thus evolved into an "AI-assisted crime solving" story right in its own conference room.
Bug Hidden in Executive Conference Room, 35-Year-Old Engineer Conducted Reconnaissance in Advance
Here is how the incident unfolded.
Around September 30, OpenAI's technical anti-eavesdropping team found the device referred to as "Recording Device No.1" in the complaint during an inspection of an executive conference room in its San Francisco office building.
The device was plugged into the USB port on the back of the conference room TV, blocked by a ball of toilet paper on the outside. The company estimated that it was installed about two days earlier (around September 28).
Photos of the device and its installation location released by the U.S. Department of Justice. The red circle on the left marks the toilet paper stuffed behind the TV, and the right side shows Recording Device No.1 with an antenna
The camouflage method looks crude, but the internal configuration is far from simple.
From the high-definition photo of the physical evidence released by the Department of Justice, a wireless antenna marked with "seeed studio 2.4G A-02" is connected to the exposed circuit board.
OpenAI disclosed that this device is equipped with advanced encryption and audio monitoring functions, as well as a data transmission mechanism designed to evade surveillance.
The executive conference room where the device was located is normally dedicated to discussing the company's core confidential information.
The complaint reveals that highly confidential technical, commercial and strategic information is frequently discussed in this room.
The topics cover proprietary research, product plans, technical progress, strategic decisions, capability priorities, government communications and business partnership arrangements.
OpenAI's MB0 office building in San Francisco (file photo)
The identified involved employee is 35-year-old Abdulrahman Alfozan, who has worked as an engineer on OpenAI's product team since July 2025.
Public information shows that he served as Engineering Lead of the AI Agent Platform at OpenAI, previously worked as a Senior Systems Engineer at Meta, and holds a Master's degree in Data Science from the University of California, Berkeley.
Alfozan's public GitHub homepage, with the pinned project being the official OpenAI Agent framework
According to the company's permission management rules, he had neither the access to enter this executive conference room, nor the qualification to attend any meetings held there.
But before installing the device, he had already scouted the location inside the company in advance.
According to footage captured by the office surveillance, he had appeared near this executive conference room multiple times before the device was discovered.
He also repeatedly inquired about the office building address, conference room capacity and calendar schedules through an internal productivity tool, specifically asking about the locations of "leadership and executives" and the meeting arrangements of external partners.
Asked AI for Advice on Installing a Bug, Exposed All Hardware Information of the Device
After figuring out where the executives held their meetings, the next step was to prepare the recording device.
A string of chatbot query records released by the Department of Justice in the complaint fully exposed the entire preparation process of the crime.
From September 24 to September 30, the period between when the device was installed in the conference room and when it was discovered, a chatbot account linked to Alfozan's spouse submitted a series of intensive questions related to recording devices.
Coincidentally, on September 24, a 93-minute podcast interview just went live on YouTube, which featured him prominently as "the only Saudi employee at OpenAI".
He sighed in front of the camera that his one year working at OpenAI "felt like five years spent elsewhere".
The cover and scene footage of the podcast interview launched on September 24, the very day the linked account started consulting AI about recording devices
In the chat window during the same period, the linked account that shared multiple identifiers and attributes with his own account almost asked about every step of covert recording.
This linked account successively asked about the production, customization, installation, recording, testing, concealment and remote access of recording devices.
The specific queries included how to "build a continuous audio recorder", how to "customize Wi-Fi connection", how to "improve audio and real-time listening", and how to "encrypt the SD card".
On September 27 and 28, around the time when Recording Device No.1 was installed in the conference room, the query content further targeted the specific hardware device.
The queries submitted by this account included the custom header of Recording Device No.1 in the executive conference room, as well as its unique MAC address.
The MAC address is the unique hardware information used to identify a network interface, and every device has a distinct one.
Someone tried to hide the recorder behind the TV with toilet paper and encryption methods, but the specific identifiers and technical questions about this device were all left in the chatbot's conversation records.
Traced by the Company's Own Large Model, He Was Caught on Camera When Returning to the Scene to Check
After discovering the recording device behind the TV, OpenAI deployed its own AI model to participate in the internal investigation.
The company stated in an official statement that they used their own model to analyze and understand the device and its source, identified the employee who placed the device several days earlier, and then referred the case to the FBI.
OpenAI further disclosed to the media that investigators used its own model to analyze the storage image extracted from the device, and checked the changes in underlying data.
The company also obtained evidence showing that Alfozan attempted to place more recording devices in other sensitive spaces to secretly record internal meetings.
OpenAI has not yet disclosed the specific model of the internal model that participated in the forensic analysis.
However, on X, many netizens including well-known AI blogger Andrew Curran speculated that the "detective" that made great contributions is most likely Astra, OpenAI's cutting-edge model.
The large model that usually helps programmers write code and helps users look up information has now been put to practical use in the company's own security investigation.
While using the large model to trace the source of the device, OpenAI also set up surveillance in the conference room.
This executive conference room originally had no cameras when the recording device was installed, and OpenAI installed additional cameras in the room after discovering the recording device.
Five days later on October 5, Alfozan entered this executive conference room, seemingly checking the back of the TV where Recording Device No.1 was once plugged in.
Public surveillance footage from October 5. The Department of Justice states that the footage recorded Alfozan's action of checking the back of the TV; the case charges are still pending court hearing
His action of leaning over to check the back of the TV was fully captured by the newly installed camera.
Around the same day, Alfozan left an unattended bag in another room in the OpenAI office building.
After the company's security personnel found and opened the bag, they found his wallet, identity documents, and another "Recording Device No.2" similar to Device No.1 inside.
The first device was plugged behind the TV in the executive conference room, the second was placed in his personal bag together with his identity documents, which, together with the chat records and surveillance footage, formed the core evidence chain in the prosecutor's complaint.
FBI Steps in to Make Arrest, Defending Against Offline Eavesdropping Is as Important as Defending Against Online Hackers
To avoid alerting the suspect and interfering with the investigation, OpenAI coordinated the termination time with the FBI, and gradually restricted his system and space permissions after September 30.
Subsequently, the company revoked his office building access and intranet permissions, arranged for him to take leave, and retrieved the company-issued devices assigned to him.
On October 9, FBI agents formally arrested Alfozan, and OpenAI dismissed him on the same day.
On October 13, he made his first appearance in federal court, charged with using or attempting to use an electronic device to intercept oral communications. If convicted, he faces a maximum of 5 years in prison, a fine of 250,000 U.S. dollars, and 3 years of supervised release.
Network investigation stock photo used on the official FBI website
OpenAI released a key piece of information on the same day, there is currently no indication that this employee improperly accessed or leaked the company's model weights, source code or customer data.
As for what exactly the device in the conference room recorded, whether the audio was transmitted out, and where the second device in the bag was intended to be used, the FBI's investigation is still ongoing, and the court has scheduled a detention hearing on October 19.
This investigation result relieved the public's concerns about the core code repository, but it also exposed another vulnerability of cutting-edge AI labs beyond cybersecurity.
In the past two years, major AI giants have devoted a lot of energy to preventing hackers from stealing model weights and source code, and the intranet permissions have been tightened more and more.
However, as the competition for superintelligence enters a white-hot stage, many high-value strategic directions, product rhythms and cooperation trends have often been repeatedly discussed in offline conference rooms before being written into the code repository.
As the online network defense line is built higher and higher, offline offices and conference rooms have instead become weaker points that are easier to break through from the inside.
And AI has been fully involved in