Who's Listening in the Boardroom

One of the difficulties with protecting a principal at work is that the people around them often have perfectly legitimate reasons to be there. A staff badge gets someone into the building. A company account helps them find a room, check a calendar or ask where the leadership team meets. Most of the time, that's simply how work gets done.

At OpenAI, prosecutors allege an engineer used those same conveniences to prepare for planting a recorder in an executive meeting room. The company later found the device and put the room under surveillance. A camera then recorded him returning to look behind the television.

For protectors, the uncomfortable question is how far ordinary employee access can take someone before their purpose becomes clear. This week, On the Circuit, we look at a case in which the preparation was recorded, but the person allegedly carrying it out still reached the room.

On or about September 30, OpenAI staff found an audio recorder wrapped in toilet paper and plugged into a USB port on the back of a television in an executive conference room at the company's San Francisco offices, the Justice Department said. Prosecutors allege one of its own engineers had put it there two days earlier. Abdulrahman Alfozan, 35, a Saudi national who joined OpenAI in July 2025 after working as a systems engineer at Meta, was arrested on October 9 and charged with trying to intercept oral communications. The recorder's contents were encrypted. The room hosted meetings on proprietary research, product plans and the company's government work.

The criminal complaint sets out the preparation in detail. Before the device went in, Alfozan allegedly used an internal productivity tool to ask about OpenAI's building addresses, meeting rooms, room capacities and calendars, and where leadership, executive and outside-partner meetings took place. Between September 24 and 30, a chatbot account linked to his spouse, which shared identifying details with his own account, asked how to build a continuous audio recorder, improve live listening, encrypt a memory card and reach a device remotely. On September 27 and 28 it asked about the specific recorder, down to its custom settings and the unique network address it broadcasts.

OpenAI kept the room under watch. Security cameras had already recorded Alfozan near the executive room on several dates, although he had no reason to be there, and the company put a camera in the room itself. On October 5 that camera filmed him going in and looking behind the television. The same day he left a bag unattended in another room, and OpenAI security opened it to find a second recorder like the first, alongside his wallet and ID. The full sequence from the complaint is in our Circuit Wire report. The company also says it used its own AI models to work out what the device was and where it came from.

Prosecutors moved before he could leave. In an October 8 filing asking the court to seal the case, they told a judge Alfozan had booked a one-way flight to Saudi Arabia for October 12 with his wife and another relative, and had the means and the incentive to flee, Al Jazeera reported. He was arrested the next day. OpenAI says it has no sign he reached model weights, source code or customer data, and it has fired him. FBI Director Kash Patel called protecting the technology one of the bureau's highest counterintelligence priorities. Alfozan's lawyer, William Pernik, says his client will fight the charge and his detention, and criticized the attention paid to his national origin. The charge carries up to five years in prison, and a detention hearing was set for October 19.

The recorder was a fairly ordinary piece of equipment. What made this case significant was the access allegedly used to put it in the right place. Prosecutors describe an employee researching where leadership met, appearing near the room without a work reason and eventually leaving a device behind the television. He did not have to force his way into the building.

Once the device was discovered, OpenAI's response produced further evidence. A camera captured his return to the room, security found another recorder in his bag, and investigators could examine the searches associated with the preparation.

There is still much we do not know, including what the encrypted recorder captured. OpenAI's statement that it found no sign of access to model weights, source code or customer data is reassuring within those limits. But the alleged target was a room where executives discussed research, products and government work. The information worth protecting was also being spoken aloud.

🇸🇦 Saudi Arabia. A Houthi projectile injured six people in a residential area of Najran on October 18. Riyadh schools remain remote, and US government staff may not go within 20 miles of the Yemen border.

🇫🇷 France. The Interior Ministry says nearly 2,400 people were arrested and about 1,000 police and gendarmes injured in the October 17 cost-of-living riots. Limoges's city hall was set on fire.

🇦🇱 Albania. Student-led protests in Tirana ran into a sixth day on October 18, with 272 people injured, 169 of them police. Prime Minister Edi Rama blames a "foreign hand" and refuses to resign.

🇱🇧 Lebanon. The US Embassy in Beirut warned on October 18 that Iran and aligned groups may target US interests, businesses and institutions worldwide, and that flights may be cancelled at short notice.

An old venue, a familiar plan and very little time to prepare. None of that will sound unusual to anyone who has worked public appearances. In Nara, those conditions formed the background to Shinzo Abe's assassination. The officer watching the road behind him was redirected shortly before the shooting, and the first shot was not recognized for what it was. The gunman had time to fire again.

In this week's Premium article, we examine the decisions behind those failures and what the official review tells us about each one. We also look at the changes Japan made and what happened when another prime minister was attacked nine months later. Alongside the analysis, the Nara After-Action Worksheet helps your team question a plan that may feel familiar, particularly who is watching each approach and what happens when somebody changes position.

Upgrade for subscriber-only tactical analysis and every future briefing →

STATE THREAT. British Prime Minister Andy Burnham told Parliament on October 12 that Iran's Revolutionary Guard almost certainly directed the plot against RAF Fairford, the English base US bombers flew from. Britain sanctioned the head of the Guard's counterespionage operations and summoned Iran's ambassador. All seven people arrested remain on bail and none has been charged, Al Jazeera reported.

INSIDER RISK. The Justice Department charged 14 people over a North Korean scheme that placed fake remote IT workers at more than 70 US companies, earning about $3 million. Two Americans were arrested for lending their identities and hosting company laptops. The FBI says the workers now pay Americans to sit interviews and drug tests, and some have sent people to intimidate former employers.

Q: Which source do you trust most when a travel picture changes overnight?

⬜️⬜️⬜️⬜️⬜️ Government advisories (0%)
🟧🟧⬜️⬜️⬜️ Airline and aviation notices (29%)
🟩🟩🟩🟩⬜️ Your own contacts on the ground (71%)
⬜️⬜️⬜️⬜️⬜️ Something else. Let us know → (0%)