OpenAI Engineer Arrested for Allegedly Installing Eavesdropping Device; Employees Say They Warned of Security Vulnerabilities for Years

Alfozan Accused of Installing Eavesdropping Device

The U.S. Department of Justice said on October 13 that U.S. federal law enforcement officers arrested Saudi national Abdulrahman Alfozan and accused him of installing a hidden recording device in an executive conference room. The device was concealed in toilet paper to avoid detection. Alfozan, 35, was an engineer at OpenAI at the time.

According to five people familiar with the matter, as early as late 2022, before OpenAI launched ChatGPT, some company employees had already raised concerns internally about its security practices. These employees had expressed relevant concerns to OpenAI's senior leadership and board of directors. However, after communicating with management and the board, some employees concluded that management was more focused on keeping pace with competitors such as Google and Anthropic than on security itself.

The people familiar with the matter said these employees believed that OpenAI's security controls were too lax, such that outsiders (including foreign governments) could relatively easily obtain the company's sensitive technical information. For example, any OpenAI employee with access to the company's code could view the technical details behind many of the company's projects.

According to two people familiar with the matter, OpenAI has begun adjusting its strategy to address security issues. Thibault Sottiaux, a senior management member responsible for overseeing product development, recently took charge of an internal initiative aimed at strengthening the security of OpenAI's internal systems. In August this year, Sottiaux reassigned a quarter of OpenAI's production engineers to improve its security infrastructure.

These internal warnings, including employees' complaints to leadership over the years about internal vulnerabilities, some details of which had not been previously reported, reveal a tension within the AI field. Since ChatGPT's launch in late 2022, AI technology has become a strategic asset of the United States, putting pressure on U.S. companies to protect their technology from foreign competitors.

However, adding more layers of security protection may also slow the progress of advancing AI technology and could complicate the large-scale IPO plans of OpenAI and Anthropic. These IPOs would place them among the world's most valuable companies.

Will DePue, a former researcher who resigned from OpenAI in April this year, posted on X that under such intense competition, leaders in the AI field "cannot sacrifice speed of development for security. For them, advancing technology quickly is more important than ensuring security; even when defending against the most powerful state adversaries, they still put speed above security."

When asked about employees' concerns and their view that management had not acted on these issues, OpenAI spokesperson Elana Widmann said OpenAI is one of the most targeted institutions in the world. She said that as a result, the company has invested heavily in its security program to defend against attacks from insiders, cybercriminals and state actors.

"Protecting our technology, data and employees is a responsibility we take very seriously, and it is work of national importance. Our recent actions show that this security mechanism is working: identifying risks and responding decisively. As technology and threats continue to evolve, we will continue to strengthen our defenses," Widmann said.