Seven controls AI labs should run now that nation-state infiltration isn't theoretical anymore—prompted by the OpenAI espionage case.
A federal judge in California ordered Abdulrahman Alfozan, a former OpenAI engineer, to remain in custody on October 19, according to court filings. Prosecutors allege he was working for a foreign government; the FBI says agents recovered a folder labeled “Saudi Gov Docs” and alleges he spied on company executives. The judge, per the detention order, cited the Saudi government’s offer to help secure his release as the equivalent of a “blank check” and found him a flight risk.
Alfozan has pleaded not guilty and is presumed innocent. None of the allegations has been proven in court. His defense counsel did not respond to a request for comment before publication, and nothing here should be read as a finding of fact — only as what the charging documents and detention order state.
So set the courtroom aside. What you actually get here is a free tabletop exercise: a nation-state, allegedly, deciding your model weights are worth deploying a human asset to acquire. If that scenario isn’t already in your threat model, run this list before it’s your incident, not someone else’s news story.
1. Inventory who can touch the crown jewels — weights, checkpoints, training data
Not “who has a laptop.” Who can read a weights bucket, pull a checkpoint, or query raw training corpora. Most labs can’t answer this in under a day, which is the whole problem. Least privilege on the three things a foreign intelligence service would actually pay for, then justify every name on the list. The 2 a.m. version of this question — asked after the access logs already look wrong — is a much worse time to start building the inventory.
2. Log bulk access and alert on the shape of exfiltration, not the act
Nobody sends a weights file to a personal Gmail with the subject line “Stolen IP.” Exfiltration looks like slightly-too-much legitimate access: a researcher pulling checkpoints they’ve never touched, at hours they don’t work, in volumes that don’t match their project. Alert on deviation from a baseline. If you don’t have the baseline, you don’t have detection — you have a log you’ll read after a federal filing tells you to.
3. Wall off executive comms from engineering reach
The FBI alleges Alfozan spied on executives. Whatever the facts, ask the uncomfortable question: could one of your engineers read the leadership team’s calendars, docs, or Slack today? In a lot of fast-growing labs the answer is yes, because flat access felt like velocity in year one. Compartmentalize. Engineering privilege should not be a side door into the boardroom.
4. Make offboarding atomic — and test it with a stopwatch
When someone leaves, revocation should be a single action that kills SSO, API keys, cloud credentials, and any agent or service tokens they minted. Partial offboarding is where the long tail of risk lives. Pull a random former employee and prove, today, that every credential they ever held is dead. If that takes more than an hour, you have a finding.
5. Treat agent and service credentials as insiders
Human access gets reviewed; the service account an engineer spun up for a one-off job six months ago does not. Long-lived tokens, over-scoped MCP server credentials, and machine identities with standing access to weights are insiders with no HR file and no exit interview. Rotate them, scope them, and put them in the same inventory as the humans.
6. Run foreign-influence review as process, not profiling
This is the one that goes wrong fastest. The goal is a consistent, documented conflict-of-interest and outside-funding process applied to everyone with crown-jewel access — not suspicion aimed at nationality, ethnicity, or an accent. Nation-state conduct is the threat. A person’s passport is not evidence, and building controls on that premise is both illegal and useless.
7. Tabletop the nation-state scenario before the subpoena does
Publicly confirmed cases have already established that states treat AI IP as strategic. Assume the recruited insider, assume the patient six-month exfiltration, and walk the whole chain: detection, legal hold, evidence preservation. Dress-rehearsed is cheaper than improvised.
If you only do one thing this week: answer question one. You cannot protect the weights, the checkpoints, and the training data until you can name everyone who can touch them — and that list is almost certainly longer than you think.