The case of the OpenAI engineer whom the FBI arrested over a bug in an executive conference room is becoming clearer. The criminal complaint shows that, according to prosecutors, 35-year-old Abdulrahman Alfozan spent several weeks consulting artificial intelligence on how to assemble, activate, and conceal the listening device. Investigators have now described both the inexpensive device itself and the unusual episode involving a lost backpack that ultimately implicated the man.
Alfozan is a Saudi citizen and permanent resident of the United States. He joined OpenAI in July 2025, and the company dismissed him on the day of his arrest.
Only executives are allowed in the room
The conference room that Alfozan allegedly selected was no ordinary company meeting room. Only executives and their assistants can book it. The company's top managers meet there, technical and product meetings take place there, and executives receive business partners and government officials there. According to the criminal complaint, highly confidential matters are often discussed in the room, ranging from research and upcoming products to business strategy and relations with government agencies.
Alfozan did not have access to it and was not invited to the meetings. Nevertheless, cameras captured him near the room several times before the bug was discovered.
The chatbot advised him at every step
According to prosecutors, Alfozan began preparing weeks in advance. He used an unspecified productivity assistant and an artificial intelligence chatbot. Through an internal OpenAI tool, he looked up which meetings were scheduled to take place in the room he had selected. He also searched for office addresses, conference room capacities, calendars, and locations frequented by company executives or used for meetings with partners.
According to investigators, he then asked technical questions through his wife's chatbot account. Between September 24 and 30, the account submitted a series of queries about continuous audio recording, Wi-Fi connectivity, real-time listening, disguising the device, remote control, and encrypting the memory card. The account shared several identifying details with Alfozan's own profile, helping investigators link the two.
According to the complaint, some queries referred directly to the bug that the security team later found. They mentioned its modified header and, most importantly, its unique MAC address, which serves as a distinct hardware identifier. Therefore, when someone asks a chatbot about a specific MAC address, they are asking about one particular piece of hardware.
A “sophisticated” bug from a hobbyist store
OpenAI described the device as sophisticated in its statement. According to authorities, however, it was a Seeed XIAO ESP32-S3 Sense, a development board roughly the size of a thumb. Such boards are commonly purchased by hobbyists who use them to build their own smart devices. This model has a detachable camera sensor, a digital microphone, and a memory card slot. It costs just under $14 on the manufacturer's website.
According to the complaint, Alfozan installed it no later than around September 28. He wrapped it in toilet paper and inserted it into a USB port on the back of the television in the conference room. The security team discovered it during a routine inspection on September 30. Technicians then attempted to download the contents of the memory card, but encountered encryption and were unable to read the data. It is not yet clear which conversations the bug captured or whether the recordings reached anyone else.
His backpack gave him away
After discovering the device, the company secretly installed a camera in the conference room. On October 5, it recorded Alfozan entering the room and looking behind the television, precisely where the device had previously been located.
Later that same day, the man left a backpack unattended in a printer room. The security team searched it and found his wallet, other personal belongings, and a second encrypted bug of the same type. They removed this bug from the backpack.
Alfozan then reported the backpack missing to the company and collected it from lost and found. He subsequently complained that some items were missing from it. He listed a payment card, approximately $500 in cash, and two pairs of AirPods. According to prosecutors, he did not mention the second listening device that was missing from the backpack.
Meanwhile, the company informed the FBI and gradually revoked his access to its systems during the investigation to avoid arousing suspicion.
AI helped both sides
The case has an unusual twist. While Alfozan allegedly used a chatbot for advice on preparing the bug, OpenAI deployed its own artificial intelligence models to catch him. They helped the company disassemble the device and trace its origin. The company did not disclose exactly which models and procedures it used. It then supplemented the findings with chat and camera records and the contents of the backpack.
OpenAI says it has no indication that Alfozan gained unauthorized access to model weights—the core of what the artificial intelligence learned during training. Nor did he gain access to source code or customer data. The company says it considers protecting its technology, data, and people a matter of national importance.
The motive remains undisclosed
FBI Director Kash Patel said that Alfozan wanted to secretly capture sensitive conversations about the superintelligence technology the company is developing. However, neither prosecutors nor OpenAI have said why he did it or for whom. Although federal authorities portray the case as a matter of national security and the protection of American technology, the Justice Department has not identified any foreign sponsor or alleged that Alfozan acted on behalf of the Saudi government.
The complaint charges him with using an electronic device to intercept oral communications. On Tuesday, he appeared before a federal court in San Francisco. If convicted, he faces up to five years in prison, a fine of up to a quarter of a million dollars, and three years of supervised release. The charge has not yet been proven in court, and Alfozan has not commented on it.
Alfozan's background
According to his LinkedIn profile, Alfozan previously worked at a freight logistics startup and at Meta. In a recent podcast, he mentioned that he belongs to a group of Saudi engineers in Silicon Valley who provide consulting services to Saudi organizations. He also worked part-time as a partner at the Saudi investment firm RAED Ventures. Neither it nor Meta has yet responded to journalists' questions.
Last year, the Trump administration reached an agreement with Saudi Arabia that gives the kingdom access to advanced chips and artificial intelligence technologies that might otherwise have remained restricted because of national security concerns. Saudi investment funds are major sources of financing for American technology companies.
Sources: wired.com and cyberinsider.com
