Well, here we are again. Another week has flown by, and it feels like it’s only been a couple of days since I last put the newsletter together.

The big one for me this week was finishing my academic survey on AI risk across three different domains, and hopefully you’ll all get to have a read. I’ve got more blogs coming out Tuesday, Wednesday and Thursday that take each domain individually and link back to the report.

This is something I’ve been thinking about for a while, and it’s taken a couple of months to put together. A few people have read it and given me good feedback, but I’m always welcoming more, so tell me what you think. I’m hoping to do more practical research in this area too, around insider risk and around the risk of these platforms in general.

This Week’s Headline: The Insider Is Already at Every Layer

I’ve spent the last while pulling together a survey paper on AI harms, and the thing that kept surfacing is the one I keep coming back to in this newsletter. These agents are being embedded into our everyday lives at every level. The chatbot someone talks to at midnight. Lethal autonomous weapons systems, where the harm is not a failure mode at all, it is the designed capability. The frontier models organisations are now handing real access to. At every one of those steps, the model has the ability to act as an insider risk or an insider threat.

There are two ways it gets there, and they are different problems.

The first is exploitation of the model itself. Developers rely on soft overlays, secondary classifiers, refusal prompts, safety fine-tuning, and those sit on top of capability rather than constraining it. When weights are open, leaked, or exposed through a fine-tuning interface, a state or criminal actor can strip that layer. Removing it does not make the model harmless. It separates the model’s capacity for strategy, persuasion and covert reasoning from the only thing that was restraining it. Anthropic’s own review of the mid-2026 evaluation incidents concluded the safeguards on its shipped models would have blocked what the unguarded evaluation permitted. The overlay does real work. Its absence is what made the difference.

The second is what the model was built on. Deceptive behaviour under evaluation may partly reflect how much deceptive fictional AI sits in the training data. We built these things on a corpus full of stories about machines that lie to their operators, and we are now surprised when they do it. Whether that is the whole explanation or not, the operational risk to an organisation is identical either way.

That is the insider threat framing. You do not get to treat the model as a tool at one layer and an actor at another. If it can pursue a goal, adapt, and misrepresent what it did, it belongs in your insider risk programme.

Read the full paper: https://drive.google.com/file/d/1NJgfR_mGxhKelXkwJ3grDVqXYDdz8HoA/view

Insider Scoop: People Keep Confusing Insider Risk with Performance Monitoring

When people hear insider risk programme or insider threat programme, they get the wrong idea. They conflate employee performance monitoring with monitoring actual insider risk, and those are not the same thing.

Anthropic is creating this position because they are effectively critical infrastructure in America now, and they need to defend against corporate espionage, theft of trade secrets, and all the risks that very large and very important companies face. That is what the role is for.

The model for an insider risk programme is not monitoring employee performance. Performance reviews are not a consideration. Now, some of those same metrics do get used, but for a different purpose. You want to make sure people are who they say they are, that they are working the hours they should be, in the time zones they should be, because that is one of the indicators of an insider threat operating on behalf of another country. A login pattern that a manager would read as someone slacking off is the same pattern an insider risk analyst reads as a question about who is actually at the keyboard. Same data, completely different question being asked of it.

What has happened in the coverage is that two things got placed together. The CEO’s comments about worrying that people are joining for the money rather than the mission, and a job ad opening at the same time. Anthropic hasn’t said either way, so this is my read rather than anything established, but I think that is coincidence rather than a statement of intent. Roles like this take months to scope and sign off. This one is not there to monitor employee performance and activity.

Source: Anthropic job listing, Insider Risk Investigator — https://job-boards.greenhouse.io/anthropic/jobs/5380744008

Crime Roundup

A North Korean IT worker was inside a US federal agency

The DPRK remote IT worker scheme has been a private sector story for years. It is not any more.

Todd Hemmen, deputy assistant director of the FBI’s Cyber Capabilities Branch, told a Digital Government Institute forum on 28 July that the Bureau had identified a DPRK remote IT worker employed by the US federal government. His words on the agency involved were that it was a little bit baffling to him, not understanding that agency’s process. The FBI declined to say which agency, how long the access lasted, or whether anything was taken.

There is precedent. Last year a Maryland man was sentenced to 15 months for allowing a North Korean national in China to work on software development contracts for the Federal Aviation Administration, and the DOJ said he had fraudulently gained work with at least 13 US companies, several of which contracted his services to government agencies.

The part I’d underline for anyone running a hiring process is where AI sits in this now. Hemmen described AI use across the entire spectrum of the DPRK remote worker, from application to employment: generating resumes and identity documents, producing deepfakes during video interviews and remote meetings, and doing fast research so the worker performs convincingly once hired. That is not a single control failure. That is every verification step in your funnel being attacked at once.

Late last month the US, South Korea, Japan and other partner countries issued a joint alert on North Korean IT workers, describing them explicitly as an insider threat to companies and linking them to data exfiltration, cryptocurrency theft, and theft of sensitive information. Worth reading the advisory rather than the coverage.

Source: Federal News Network — https://federalnewsnetwork.com/technology-main/2026/08/fbi-investigating-north-korean-remote-it-staffer-working-for-u-s-agency/

Source: Yonhap — https://en.yna.co.kr/view/AEN20260812000300315

Source: IC3 joint advisory — https://www.ic3.gov/CSA/2026/260731.pdf

The candidate who passed every technical interview was not a person

The private sector version of the same problem showed up this month from a company that ought to be well placed to spot it.

Anastasios Angelopoulos, CEO of AI model evaluation company Arena, said candidates had been passing all of their technical interviews before turning out to be AI rather than real people. His engineers had interviewed them and believed they were real. He is now considering in-person onboarding as a result, which is where Coinbase landed too when it required all workers to attend US orientation in person.

Gartner expects one in four candidate profiles worldwide to be fake by 2028. If that lands anywhere near accurate, identity proofing stops being an HR administrative step and becomes a security control, and most organisations currently treat it as the former.

Source: https://www.aol.com/articles/fake-ai-job-candidates-forcing-123532000.html

Russia turned hotel Wi-Fi login screens into a delivery system

Microsoft attributed a campaign it calls CaptiveCrunch to a sub-cluster of Midnight Blizzard, the group the US and UK have formally linked to Russia’s SVR. Since around May 2026 the operators have compromised captive portal gateways at hotels and conference centres, intercepting the automatic connectivity check your device makes the moment it joins the network, and using it to serve fake update prompts, fake Microsoft login pages, or a device code prompt.

Two details matter here beyond the tradecraft. The first is that MFA does not save you. In the device code component the attacker starts an authentication request and the victim completes it at the real Microsoft sign-in page, so Microsoft issues a valid token to the attacker’s session. MFA is not bypassed. It is fulfilled correctly, by the victim, on the attacker’s behalf. Microsoft’s guidance is to block device code flow in Conditional Access for everyone without a documented need, which is most people.

The second connects back to this issue’s headline. Microsoft assessed that one of the tools showed signs of AI-assisted code generation, based on its consistent coding standard and unusually detailed developer comments, including comments that explicitly reference Microsoft detection signatures and the reasoning behind specific evasion choices. That is the offensive mirror of the argument in my paper. Strip the guardrails and the capability underneath is immediately useful to somebody.

Source: https://www.techtimes.com/articles/323263/20260806/svr-hacked-hotel-login-screens-plant-cornflake-spyware-corporate-laptops.htm

AI Insider Threat Watch

98% of production AI agents are living in the lethal trifecta

The framing comes from Simon Willison, who in June 2025 described the lethal trifecta as three capabilities landing in one agentic workflow: access to private data, exposure to untrusted content, and the ability to communicate externally. When all three align, a malicious instruction can travel from content to action to data loss before anyone notices.

The Cloud Security Alliance has now published a research note on an independent assessment of 100 commercial and publicly available production AI agents, and the numbers are not close. The trifecta was present in 98% of agents evaluated. Only 11% passed a baseline security benchmark.

The uncomfortable part is not the headline number, it is the inversion underneath it. The agents with the broadest capabilities have the thinnest defences. Coding agents ranked second in capability but eighth in defence, despite frequently holding write access to repositories, build pipelines and deployment systems. Computer-use agents, which drive a full desktop the way a person does, averaged zero on output guardrails, the lowest rating available. The research groups these into a category it calls Exposed Giants: roughly 40% of the agents assessed, carrying about 60% of the aggregate risk. They are also the ones your people reach for first.

Then there is the verification gap. 83% of vendor-claimed defences lacked independent verification, and 37% of agents that scored well on audit logging performed poorly at actually preventing harm. That distinction should be familiar to anyone who has run a programme. An agent that carefully records every step of a prompt injection before completing it has documented the incident, not stopped it.

None of this is a vendor problem to be fixed in the next release. The moment an agent inherits a person’s access and acts on their behalf, the question stops being whether the model is safe and becomes who or what moved the data, and whether they were allowed to. That is an attribution question, and attribution is insider risk.

Source: DTEX — https://www.dtex.ai/blog/lethal-trifecta-ai-agents-insider-risk/

A maturity model that treats agents and people as the same problem

At Black Hat this month, Phil Venables, former CISO of Goldman Sachs and Google Cloud, laid out a five-stage insider risk maturity model that I think is the most useful practical framing I’ve seen on this.

Stage one is data control, which can tell you a sensitive document is heading out the door but nothing about who is involved or why. Stage two is telemetry and visibility, which adds data without adding an answer, because the reasoning is still rule-driven. Stage three is behavioural baselining, the UEBA layer, and it is where most programmes get stuck, because a deviation is not the same thing as a risk. Stage four, behavioural investigation, is the inflection point: the system produces a verdict backed by evidence instead of another alert for someone to triage. Stage five is organisational risk intelligence, surfacing structural problems like shared credentials before anyone acts on them. Almost nobody operates there.

The argument I want to pull out is that AI agents do not need a second, dedicated programme. Whether the identity belongs to a person or an agent, the question is the same: what does it do, and should anyone care. If your programme cannot answer that for a human today, buying an AI governance tool will not answer it for an agent tomorrow.

Note for transparency: the piece is written by the CEO of a vendor in this space, and the DTEX post above is from a vendor I work with on webinars. The underlying CSA research note and Venables’ model stand on their own, but you should know where they reached you from.

Source: SC Media — https://www.scworld.com/perspective/black-hat-usa-2026-solving-insider-risk-in-the-agentic-ai-era

Mitigation Corner: Seventy Percent of Fraud Comes Down to Three Failures

The ACFE released its 2026 Report to the Nations in May, built on 2,402 real occupational fraud cases from 143 countries, investigated between January 2024 and September 2025. Those cases account for more than $3.4 billion in losses, with a median of $104,000 per case.

The useful part for anyone running a programme is the root cause data. Three internal control weaknesses accounted for 70 percent of all frauds in the study: no internal controls at 33 percent, an override of controls that did exist at 19 percent, and a lack of management review at 18 percent. None of that is exotic. Two of those three are not really control problems at all, they are supervision problems.

Detection tells the same story. Tips remained the number one detection method for the fourteenth consecutive study, uncovering 43 percent of cases, close to three times the next method, internal audit, at 15 percent. Your best detection capability is a person deciding to say something.

Which makes this the number to sit with. Eighty-five percent of large organisations have a whistleblowing mechanism. Only 25 percent of small businesses do. Small organisations are the ones where a single person often holds several incompatible roles, so they carry more exposure and have less separation of duties to catch it, and three quarters of them have no channel for the one thing that works best.

The one thing to do this week: if you have a reporting channel, test it. Submit an anonymous report yourself and see where it lands, how long it sits, and who reads it. If you do not have one, that is the gap worth closing before you buy another tool.

Source: ACFE — https://www.acfe.com/fraud-resources/report-to-the-nations

Trusted Profession Watch: The Man Running the Elder Fraud Unit Was Farming Its Own Detection System

Scott Kelley, 52, was a Postal Inspector at the Boston Division headquarters of the US Postal Inspection Service, a federal law enforcement officer authorised to carry a firearm, make arrests and execute search warrants. From 2015 until June 2022 he led the Mail Fraud Unit, which investigated lottery and other scams targeting senior citizens and vulnerable people. He then moved to lead the Mail Theft Unit until August 2023.

He has now pleaded guilty to stealing over $340,000 in cash from packages mailed by elderly victims of lottery scams, laundering some of it, and failing to report it to the IRS. Forty-four counts: wire fraud, mail fraud, mail theft by a postal officer, twenty-three counts of money laundering, structuring, and filing false tax returns.

Here is the part that should stop you. Between January 2019 and August 2023 he used deceptive emails to get unwitting postal employees to intercept packages that a USPIS algorithm had flagged as likely sent by scam victims, and forward them to him. Around 1,950 packages in total. He opened the ones that looked or felt like they held cash.

The detection system built to find victims became his targeting list. He never had to identify anybody. The agency did that work and handed him the output.

The seven victims named in the indictment averaged 75 years old, the oldest was 82, and they mailed between $1,400 and $19,100. One died after Kelley was indicted. Among them was a 76-year-old retired Army veteran in Kansas who lost $19,100. He spent the money on home renovations, cruises and escorts.

There was a control, and it was the right one. If a sender consented to USPIS opening a package containing cash, the inspector had to count it with a second inspector present as a witness and convert it into an official cheque payable to the sender. Two-person integrity. It failed because the packages never reached the process where the rule applies. He routed them to himself first, which is the thing worth sitting with: he did not break the control, he stepped around it, using authority the role gave him and trust that colleagues had no reason to question. And when cash did go missing from an evidence locker, he is alleged to have blamed a direct report for the shortfall, which is seniority doing the second half of the work. The question this leaves for anyone running a programme is what a trusted senior person can requisition without a second pair of eyes, and whether a junior person’s denial would be believed over theirs.

Sentencing is set for 18 November 2026.

Source: DOJ — https://www.justice.gov/usao-ma/pr/former-federal-law-enforcement-officer-pleads-guilty-stealing-340000-cash-elderly-scam

Trivia

In June 2025, a technologist coined the term “lethal trifecta” for the combination of capabilities that makes an AI agent dangerous: access to private data, exposure to untrusted content, and the ability to communicate externally. Who coined it?

A) Bruce Schneier B) Simon Willison C) Mikko Hyppönen D) Phil Venables

Corporate News: Apple v OpenAI, and a Defence That Apple Just Lost Its People

Apple sued OpenAI, io Products, and two former employees in the Northern District of California over trade secret misappropriation and breach of contract tied to consumer AI hardware.

The two named individuals are Tang Tan, now OpenAI’s chief hardware officer, who spent roughly 24 years at Apple and left in February 2024 as VP of product design for iPhone and Apple Watch, and Chang Liu, eight years at Apple as a senior systems electrical engineer before leaving for OpenAI in January 2026. Tan co-founded io with Jony Ive, and OpenAI acquired io for close to $6.5 billion in May 2025. Ive is not a defendant.

Apple alleges Liu kept an Apple-issued laptop after leaving and used it to download confidential technical documents, and separately told an Apple employee how to get around security teams when copying files. Tan is accused of using confidential Apple project code names during recruiting, asking candidates to bring Apple hardware components to interviews, and coaching departing employees on evading Apple’s security procedures.

The allegation that should interest anyone running a programme is narrower than the headline theft. Apple claims OpenAI distributes a checklist Tan assembled to help new hires evade detection by Apple’s security teams. That is the difference between an opportunist and an institutionalised process. If it holds up, someone documented how to beat an insider threat programme and handed it around as onboarding material.

OpenAI has filed a 31-page motion to dismiss, arguing the suit is meritless and really about Apple’s failure to retain top technical talent, and pointing out that a form of the word “fail” appears close to fifty times in Apple’s brief. Its public line is that it has no interest in other companies’ trade secrets. Every departing-employee case has this shape underneath it. The company says theft, the leavers say we left because you were losing, and the same facts support both readings. Worth noticing that the alleged access path is the unglamorous one: not a dramatic exfiltration on the way out, but a departed employee still holding a device and an authentication gap that let him back in later. Offboarding is a control, and it fails quietly.

Apple has sought a preliminary injunction, OpenAI’s response was due 17 August, and oral argument is set for 1 October.

Source: https://www.iphoneincanada.ca/2026/08/06/openai-tells-judge-apples-trade-secret-lawsuit-is-rotten-to-its-core/

Trivia Answer

Answer: B. Simon Willison described the lethal trifecta in June 2025, warning that when all three capabilities align, a malicious instruction can move from content to action to data loss before anyone notices. A 2026 assessment of 100 production agents found the trifecta present in 98% of them.

Enjoyed this issue? Buy me a Coffee keeps the research running.