Someone tucked a thumb-sized recording device into a USB port behind a conference room display at OpenAI’s San Francisco offices. Federal prosecutors say they know who did it. For the IT and AV teams who manage meeting rooms, the case raises an uncomfortable question. Who actually checks the back of the display?
The Justice Department unsealed a criminal complaint Oct. 13 charging Abdulrahman Alfozan, 35, an OpenAI engineer and Saudi national. Prosecutors allege he planted the device in an executive conference room. As Fortune first reported, OpenAI’s technical surveillance countermeasures (TSCM) team found it Sept. 30 during a routine sweep. FBI agents arrested Alfozan about a week later. The charges remain allegations, and no court has ruled on them.
What investigators found
The complaint identifies the device as a Seeed Studio XIAO ESP32-S3 Sense. The board combines a detachable camera sensor, a digital microphone, and microSD storage. It runs on 5V USB-C power or a 3.7V battery but ships without one. AV Magazine noted that the complaint photo shows no battery attached.
Alfozan allegedly wrapped the device in toilet paper and installed it on or about Sept. 28. OpenAI investigators believe someone may have modified it to block data transfer with the display. They also could not recover data from its microSD card, which suggests encryption.
Closed-circuit television (CCTV) footage placed Alfozan near the room on several dates, although he had no authorization to enter it. After the discovery, OpenAI installed a camera inside the room. On Oct. 5, that camera allegedly recorded Alfozan looking behind the display. That same day, security staff opened a bag he had left unattended. Inside, they found his wallet, his ID, and a second, similar recorder.
OpenAI said it used its own AI models to trace the device before referring the matter to the FBI. The company also said it has no indication Alfozan accessed model weights, source code, or customer data. [TK: link OpenAI statement]
Why AV teams should care
Benedict Onodu, an AV/IT manager who sits on AVIXA’s standards steering committee, spoke with AV Magazine about the case. He said displays, racks, cable routes, and unused ports often sit within reach yet out of sight. Monitoring software can flag new devices on a managed network. However, a standalone recorder that stores data locally never touches that network. Consequently, software monitoring alone cannot catch it.
Colin Birney, vice president and treasurer of the AVTrust cybersecurity standards initiative, also commented to AV Magazine. In his view, AV holds privileged access to sensitive conversations, and that access carries responsibility. An attacker, he noted, could just as easily have used a power outlet or a malicious thumb drive. Birney also questioned OpenAI’s vetting of job applicants. Letting an attacker into the building, he said, is a wider organizational failure.
What AV teams can do now
Birney recommends physical port blockers, such as Lindy’s locks for USB and High-Definition Multimedia Interface (HDMI) connections. He also advises blocking unused network ports.
Onodu outlined a broader checklist. First, secure or restrict unused ports, and design installations so staff can easily inspect connections. Next, keep an inventory of approved hardware and document changes after maintenance. In addition, audit who can access meeting rooms and AV infrastructure, contractors included. For sensitive rooms, run standard pre-meeting checks of displays, ports, cabling, and furniture. Finally, set clear escalation procedures for reporting anything suspicious.
For facility and IT leaders, the takeaway is simple. The most exposed port in the building may not appear on any network map. Instead, it may sit behind the display in the boardroom.
Tim Albright is the founder of AVNation and is the driving force behind the AVNation network. He carries the InfoComm CTS, a B.S. from Greenville College and is pursuing an M.S. in Mass Communications from Southern Illinois University at Edwardsville. When not steering the AVNation ship, Tim has spent his career designing systems for churches both large and small, Fortune 500 companies, and education facilities.
- Tim Albright
- Tim Albright
- Tim Albright
- Tim Albright
