Lisa Thiergart, co-founder and chief executive of Security Level 5, says there are likely more spies at AI companies, The Information reported on 10 November. In The Information’s TITV AI Deep Dive interview published on 9 November, host Rocket Drew asked whether she would wager that there are other spies at AI companies right now. Her answer: “I think that’s pretty likely.”
The asset at stake is the model itself. Security Level 5, Thiergart said in the interview, “is specifically about defending a narrow set of the critical assets of AI labs, such as model weights and all the code that touches those model weights from priority nation state level espionage and sabotage.”
Business Pill · Least Privilege
A one-minute explainer of least privilege: giving each system or person only the access a task needs. It teaches the general idea only and says nothing about any company or person in this story.
The key insight: Lisa Thiergart, CEO of Security Level 5, said it is “pretty likely” that there are other spies at AI companies, in The Information’s TITV interview published on 9 November. The asset she works to protect is the model weights and the code that touches them.
Drew opened the espionage segment with the OpenAI case: the US Justice Department charged engineer Abdulrahman Alfozan in October over a recording device hidden in an executive conference room, and a grand jury indicted him on 27 October on a charge of intercepting oral communications. He has not been charged with espionage and has not been convicted.
Asked what she made of the incident, Thiergart said: “It was not surprising. I think that defending against insider threats in the way that companies operate right now is really, really tough. I do think they need to do better.” She added that she was glad the company caught it on the timeline it did.
Her view of the threat is about who the attacker is. “Especially if we’re defending against priority nation states, insider threats is what they’re extremely good at,” she said. “It’s kind of hopeless to protect all of your secrets from them,” but companies “do have a shot at” triaging their secrets and protecting the most valuable ones with a lot of resources.
Asked whether she expects more incidents like this to come to light in the next year or so, she said: “Yeah, I think that’s likely.” AI labs, in her view, are aware of the threat and probably gearing up to defend against it, “but I would say this is one of the hardest things to get right.”
Minutes per chapter of The Information’s 68-minute TITV AI Deep Dive with Security Level 5 CEO Lisa Thiergart, 9 November 2026. Chapter titles are The Information’s; the minutes are our arithmetic from its chapter timestamps.
Her Fix: Fewer People, Closer to Clearances
Her remedy is access control. The best shot labs have, she said, is “reducing the number of people that can access the information and also moving towards something that is kind of closer to government style clearance for their staff.” Her organisation has published a framework for this, which she called sensitivity levels; a guest correction on The Information’s episode page says SL5’s SENL framework is for private industry, not public industry as she said on air.
She also said filtering by nationality is the wrong test: “I actually also don’t think filtering for nationality is really the right thing to be looking for here.” Long tenure, such as an employee who joined before nation states got interested in these companies, is among the “strong signs of trust”, she said.
Why the Weights Are the Business Asset
The name Security Level 5 comes from the top tier of RAND’s 2024 report “Securing AI Model Weights”, its website says. RAND identified 38 attack vectors, defined five security levels and wrote that securing weights against the most capable actors “will require significantly more investment over the coming years.” One of its recommendations matches Thiergart’s: “Reduce the number of people authorized to access the weights.”
Her group’s SL5 standard, posted in May, describes SL5 as a posture that could plausibly thwart top-priority operations by “the world’s most cyber-capable institutions”. It says “preserving optionality for SL5 by 2028/2029 requires starting now”, because facility construction, hardware procurement and staff capability must be planned years in advance. Security Level 5’s site says it aims to let frontier labs deploy SL5 within 3-6 months of the point they choose.
As we read it, that turns security into a capital decision for the labs: the protection Thiergart describes means smaller access lists, vetting closer to government practice and purpose-built facilities, each a cost that sits on top of the training run it protects. Microsoft’s Satya Nadella made a related argument in October, writing that companies should treat frontier models themselves as insider risks.
By our count from the video’s chapter timestamps, espionage and insider threats (5.9 minutes) plus model theft and distillation (8.4 minutes) took about 14 of the interview’s 68 minutes; building a secure AI data center took 13.0.
The Structural Read
As we read it, her answer moves AI lab security from an IT line item to a question about the main asset: if insiders working for nation states are hard to stop, the defence she describes is fewer people with access and vetting closer to government clearances, both of which cost money and slow hiring. She named no spy, company or country beyond the OpenAI case the host raised.
Lisa Thiergart, CEO of Security Level 5, on The Information’s TITV AI Deep Dive (our machine transcript)
“I think that defending against insider threats in the way that companies operate right now is really, really tough. I do think they need to do better.”
Three Implications
FOR AI LABS Thiergart said the best shot labs have is reducing the number of people who can access the information and moving towards something closer to government style clearance for staff.
FOR THE COST OF SECURITY RAND wrote in 2024 that securing model weights against the most capable actors will require significantly more investment over the coming years; the SL5 standard says preserving the option of SL5 by 2028/2029 requires starting now.
FOR WHAT COMES NEXT Thiergart said she thinks it is likely that more incidents like the OpenAI case will come to light in the next year or so.
The framework says: “The transformer is a commodity now; what changes between paradigms is where intelligence accumulates and who can capture it.”
As we read it, espionage is the unpriced way to capture it: a copied set of model weights or training notes moves accumulated intelligence without the training bill. The framework predates Thiergart’s interview and does not discuss espionage.
What Is Not Established
Thiergart’s answer is a judgement, not a count. In the part of the interview we transcribed she named no spy, company or country beyond the OpenAI case the host raised, and she did not say any lab’s model weights had been stolen. We could not read The Information’s article past its paywall; its open headline says “likely”, while a Facebook post by The Information says she says spies “are already working inside AI companies.”
In a separate matter, the New York Times and the FT reported allegations that US officials believe Megaspeed executive Alice Huang was a Chinese asset close to Nvidia chief executive Jensen Huang (our report; the FT-reported memo). Those allegations remain untested in public. The quotes here are from our machine transcript of the public video; small wording differences from The Information’s own text are possible.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
The head of a group building security standards for frontier AI labs says more spies at AI companies are “pretty likely” and that more incidents will probably come to light. Her prescription, echoing RAND’s, is to shrink who can touch the model weights and move staff vetting closer to government clearances.
A note on sourcing. The headline claim is from The Information, whose article we could not read past its paywall. Thiergart’s quotes are from our machine transcript (faster-whisper) of the first seven and a half minutes of The Information’s public TITV video of the interview, published on YouTube on 9 November 2026. Background on Security Level 5 is from its website and the SL5 standard on arXiv; the security levels and recommendations are from RAND’s 2024 report.
Facts on the OpenAI case are from our earlier pieces, which cite the US Justice Department and court filings. Chapter minutes are by our count from the video’s chapter timestamps, as listed on The Information’s episode page and on YouTube; they do not come from our transcript, which covers only the first seven and a half minutes.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
