Alleged Boardroom Bug at OpenAI Shows Why Physical Security Matters as Much as Cyber Defences

The US Department of Justice has charged Abdulrahman Alfozan, 35, an OpenAI engineer, with attempting to intercept oral communications. According to the complaint, a Seeed XIAO ESP32-S3 Sense recording device was plugged into a USB port on a TV in the company's executive conference room on or around 28 September 2026. Staff allegedly found it hidden in toilet paper on 30 September, and security staff reportedly found a second device in his bag. He was arrested on 9 October. These are allegations, not proven findings.

The complaint says the device may have been modified to stop data moving between the recorder and the TV, and that its microSD card may have been encrypted, because OpenAI could not retrieve any data from a forensic image. Prosecutors say CCTV placed him near the room on several dates, and that he had no authority to attend meetings there. The room was not covered by cameras when the device was planted, but one was added later and allegedly captured him checking on it on 5 October. Officials did not say whether anything important was recorded.

Court documents also allege that between about 17 August and 16 September 2026, he used a productivity agent to ask about company building addresses, meeting rooms, capacities, calendars and external-partner meeting venues. The case shows that sensitive conversations can be exposed through simple hardware, and that an insider with ordinary access may be enough.