COMMENTARY: Traditional enterprises are learning to defend themselves from AI insiders. OpenAI's alleged recording-device incident is a reminder that AI companies must still defend themselves from the human kind. Both threats reveal themselves through behavior.
The great irony of the agentic era is that enterprises must now protect themselves from AI insiders, while AI companies must protect their AI and intellectual property from human insiders.
OpenAI was reminded of the second half of that on Sept. 30, when its staff found a thumb-sized recorder, concealed in toilet paper, plugged into a USB port behind the television in an executive conference room. A federal complaint unsealed on Oct. 13 alleges an OpenAI engineer, Abdulrahman Alfozan, put it there. He is charged with intercepting oral communications and is presumed innocent. OpenAI says it has no indication that model weights, source code or customer data were accessed.
What interests me is how prosecutors say the plan took shape: in calendar lookups and chatbot prompts as much as on camera.
Companies are building defenses against AI insiders while an AI lab deals with a human one. The same record serves both. It starts with an instruction, and it shows what the actor did next.
Related reading:
These can look like two separate disciplines. I'd argue they are one. In both cases, a trusted actor has legitimate access to something valuable, starts using it for a purpose the organization never approved, then tries to stay outside normal scrutiny. An engineer and an agent leave different telemetry, but the problem has the same shape.
Read the complaint as an investigator would
The device is the least interesting part of the complaint. The sequence of behavior around it is more revealing. Prosecutors say Alfozan used an internal productivity tool to look up meeting rooms, calendars and where "leadership and exec" meetings were held. A chatbot account associated with his spouse, which shared identifiers with his own, allegedly submitted prompts about building a continuous audio recorder and encrypting the SD card.
Almost none of this required a broken permission. Querying meeting rooms is routine, and plenty of engineers use chatbots every hour. The warning sign was where his interest was heading: toward rooms and people outside his role, then toward obscuring what he was doing. Prompts about obfuscating a device, routed through an account in his spouse's name, would suggest an attempt to dodge attribution.
Concealment gives the game away
Insider risk practitioners learned long ago that access rarely exposes an insider. Most people with sensitive access never misuse it. Concealment says much more, because people doing what they were hired to do seldom bother hiding it.
Agents can behave the same way. In July, OpenAI agents under cybersecurity evaluation escaped their sandbox and breached Hugging Face, according to OpenAI. An independent investigation by METR and Redwood found about 1,200 agents coordinating through a message board nobody had sanctioned.We have also seen agents split archives to stay under platform size limits and send files through public sharing services. Any insider investigator would recognize the pattern: a legitimate actor working around oversight instead of through it.
So the useful question for a security team is whose behavior has moved away from the purpose it was trusted for, and whether anything tried to hide that.
Why AI behavioral analysis will carry the load
The case has a further twist. Prompts allegedly typed into a chatbot became some of the clearest evidence of intent. For humans, AI interactions are now part of the behavioral record. For agents, they are close to the whole record. An instruction, read alongside what happens next on endpoints and networks, gives security teams a trail of intent they never had five years ago.
That trail only becomes useful when it's correlated. A prompt about encrypting an SD card means little on its own. Put it next to calendar lookups for executive meetings and a recorder found behind a boardroom TV, and the intent is hard to miss.
Correlation also means not taking the actor's word for it. An agent's logs are its own version of events, much as an insider's explanation is theirs. Independent endpoint and network evidence lets an analyst test either account.
For CISOs, the practical step is to stop running human insider programs and AI governance as separate workstreams with different owners. Bring agents into the insider risk program, and bring AI interaction data into human investigations. Then check whether your team could reconstruct any sensitive action from last week, including who or what started it and whether anything tried to hide what followed.
Whether the insider is an engineer inside an AI lab or an agent inside an enterprise, the defense is the same: understand what the actor intends, and look for the behavioral evidence that it is trying to operate outside normal scrutiny. Permissions show what someone may do. Only behavior shows what they did with it. Agents work through a system in minutes, and people now have AI to help plan their moves, so intent has to be read as it forms. Behavioral analysis is how that happens at speed. Without it, the first proof of an insider's intent will be the damage.
