[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.
Industry News
Vendor, policy and market news that affects defenders.
confirmed (DOJ + company)
OpenAI: employee arrested for planting a recording device in an executive conference room
OpenAI said it found a hidden recording device, used its own AI to trace it, and referred the case to the FBI. DOJ says Abdulrahman Alfozan was arrested Oct 9 and charged with intercepting oral communications. OpenAI says it has no indication that model weights, source code or customer data were accessed or exfiltrated. The employee was terminated. Insider-threat reminder for AI labs.
DOJ/FBI disrupt DPRK remote IT worker "laptop farms" affecting 70+ U.S. companies
DOJ announced coordinated actions against North Korean remote IT-worker schemes that place fraudulently hired workers inside U.S. firms via stolen identities and U.S.-based laptop farms. Actions include indictments, arrests of U.S. facilitators, and searches; CrowdStrike published assistance on disrupting FAMOUS CHOLLIMA operations. Defender takeaway: identity proofing for remote hires, geolocation/device anomalies on corporate endpoints, and vendor/contractor access reviews remain high priority.