OpenAI teaches its employees to watch strangers in playgrounds and calls that security. Federal prosecutors charged Abdulrahman Alfozan this week with planting a recording device behind a television in a company conference room, under a federal recording statute and nothing more serious than that. His lawyer says the allegations are wholly out of character and points out, correctly, that he is not charged with stealing trade secrets or acting as a foreign agent. The company had already described the incident publicly in the arrest coverage from last week. Physical approaches are real, and OpenAI, Anthropic and Google all brief their people on strangers, listening devices and honey-pot operations, so none of that training is foolish. The question this case actually raises is not whether one man put a recorder behind a television. It is what the training is aimed at, and where the thing it is meant to protect physically lives.
Read the list the Journal obtained. Employees are told not to wear company-branded clothing in public, to fit screen protectors on laptops on public transit, and to wipe whiteboards when they finish in case the cleaning staff has been compromised. In one scenario a stranger befriends an employee’s child at a San Francisco playground over repeat visits and uses the small talk to ask about the employee’s work. Another briefing walks through honey-pot operations, closing on the anecdote about champagne sent to a diplomat’s hotel room in Russia. Every item on that list addresses a human body in a room, or speech in a room, or a surface a human eye can reach. State services do run physical approaches, and the training is not imaginary. But it is a list about rooms, and the rooms are not where the value is.
At a frontier lab the valuable object is a set of trained parameters — checkpoint files, gigabytes to single-digit terabytes depending on the model — sitting in cloud object storage behind an identity provider, reachable through a notebook, a model registry or a sync client. Around it sits the rest of the value: the post-training preference data and reward models that shape behaviour, the evaluation harness and its results, which is the scorecard deciding which checkpoint ships, and the internal research notes and experiment logs recording what was tried and what worked. None of that is speech. All of it is a file, and files leave through authenticated channels that generate records — if anyone is required to keep and read them. The company’s own disclosed incidents have run through software rather than through rooms: it reported that its agents leaked fifty-three user images, and that its agents scanned a United Nations trade site sixteen thousand times while bypassing its filters.
What Aviv Nahum, chief executive of Above Security, describes as the traditional approach — verify identity at hire, then trust that whatever that identity does afterward is legitimate — is an authentication decision, not a monitoring architecture. Authentication answers who is at the door. It says nothing about what that person carries out of it. A data-centric programme is a different build: access logs from the object store and the model registry, correlated in a security information and event management system, which is the correlation engine where separate log streams are joined, against a baseline of that person’s ordinary footprint; egress controls on laptops and network exits, which are the monitors watching what leaves; and alert rules keyed to data objects rather than to job titles. First read of the weight store by someone outside the serving team. Bulk download outside a project’s footprint. A notebook exporting to local disk. Credentials exercised from a geography the identity has never used. Each of those is a cheap query against logs these companies already generate. In a machine shop the tooling is signed out item by item, and the sign-out sheet is the audit trail. The door being locked is not the audit trail.
Where the gaps sit, as a category, is the part worth arguing. Read scopes are granted wide because research velocity depends on it. Notebooks and experiment runners cache training data locally. Sync clients mirror work directories onto personal devices. Service credentials outlive the projects they were minted for. And alert rules, where they exist, tend to key to identity — this person has given notice, this person is departing — rather than to the data object in motion. Both convictions in the record are off-pattern use of legitimate access: the former Twitter employee convicted in 2022 and sentenced to forty-two months for passing private user data on critics of the Saudi government, and the former Google engineer convicted in January over thousands of pages of internal AI material. Neither involved a planted device. The record the industry itself can cite for insider damage is a record of file copies.
Randy Watt, president of the security consultancy SRW, put the operating assumption of the trade plainly: catching one guy means there are half a dozen out there. The quantity worth arguing about is not that assumption but capacity. Access events grow faster than headcount, because each new engineer touches more repositories, more notebooks and more buckets than the cohort before, so the alert stream grows superlinearly while the triage cost of each alert stays fixed at a few analyst minutes. If the correlation rules do not improve, alert volume outruns triage and the programme degrades into precisely what the observable evidence shows — a badge desk and a recurring training. It is fair to say I do not have OpenAI’s internal numbers and neither does the reader; the reporting describes the classroom, not the telemetry, and the absence of telemetry from the public record is not proof of its absence inside. It is, though, the first artefact anyone would ask for, and it is the one nothing in this story has been asked to produce.
The administration’s stated vulnerability — the substantial share of the world’s leading AI researchers supplied by China — is a workforce fact, and it has produced the legible response, which is a lens sorted by passport. Conduct monitoring is the response that addresses the mechanism. Both convictions above are conduct cases, involving people with the right to read what they read. A passport lens catches passport. Applied seriously it would sweep in much of the workforce these companies cannot operate without, and it converts a monitoring failure into a loyalty test that no amount of screening can answer, because the question it can answer is who someone is, and the question that matters is what happened after the badge.
Phil Venables, formerly chief information security officer at Google Cloud, is right that the cost of training foundation models is what makes the resulting property uniquely valuable, and the same fact makes the enforcement regime peculiar. The only remedy in the record for taking the files is a contract and a lawsuit: OpenAI and Apple are litigating over departed engineers and confidential files, and xAI has sued an engineer who joined OpenAI. Trade-secret law operates after departure, in court, years later, and its remedy is money. Compare that with the architecture that already exists for protecting a technical asset in a country that takes the question seriously: a cleared facility grants access per document rather than per person, logs the reads, and can produce the audit trail on demand. That architecture is not exotic. It is a database and a policy. The nearest regulatory equivalents say nothing close — the European AI Act’s documentation duties for general-purpose models cover technical documentation, a summary of the training data and evaluation results, not a lineage of who opened the weight store, and the American risk-management framework is voluntary. A workable rule is short enough to write: above a training-compute threshold, every read of the weight store and the training corpus is logged, retained for a defined period, and producible on demand.
The arrest is a real arrest under a real statute, and if the charge is proven the man put a recorder behind a television. Everything assembled around it is aimed at the wrong surface. The training tells an engineer to wipe a whiteboard because the cleaners might read English; the parameters move through a bucket whose read history no regulator currently requires anyone to keep. The useful question is not whether more people will try. It is whether the company can hand over, today, a list of who read the weight store last quarter — and the way to find out is to ask for it.