A badge that opens the building is not permission to be in every room. A vendor's remote-support login is not permission to touch every system. Several cases in a single week show what happens when organizations treat access and authorization as the same thing.

One week, four access paths

The Justice Department charged an OpenAI engineer after a hidden audio recorder was found in an executive conference room. Federal prosecutors in California charged a Navy construction contractor's employee who allegedly used his base credential to film sensitive equipment and exercises. The FBI warned that facilitators for North Korean IT workers "appear in-person at victim companies ... for intimidation." And two vendor remote-access paths, a BeyondTrust Remote Support flaw and a ConnectWise Cloud Backup application identity, were used to reach customer environments.

The charged individuals are presumed innocent. The access lessons do not depend on how the cases end.

Building access is not room authority

According to the Justice Department, the OpenAI engineer, employed since July 2025, was arrested October 9 on a charge of using or endeavoring to use a device to intercept oral communications. Per the complaint, OpenAI found the device around September 30, concealed in toilet paper and plugged into a USB port behind a television in an executive conference room in San Francisco. It had been installed around September 28.

According to DOJ, he "had no authority to access or to participate in meetings occurring in the executive conference room." He had building access. He did not have authority for that room. Those are different decisions, and an access control program has to make both.

High-value rooms (executive conference rooms, board rooms, labs, control rooms) warrant their own credential tier, separate from general building access, with an access log that someone actually reviews.

Camera coverage of the room and its approaches

SecurityWeek, carrying an Associated Press report, says the room "did not have a camera at the time it was installed." According to DOJ, CCTV inside the office showed him near the room on multiple dates, and the AP report says a camera added afterward recorded him checking behind the television. Coverage outside the room, not in the room itself, is what placed him near it.

Camera placement for sensitive rooms should cover entrances and approaches.

As practice guidance, not a finding from this case, PSG recommends periodic technical surveillance countermeasures (TSCM) sweeps for executive and board rooms, plus a simple inspection checklist for USB ports, AV equipment and the space behind displays before sensitive meetings.

Calendars and directories are reconnaissance data

Before the device was planted, according to DOJ, he used a productivity tool to make inquiries about "building addresses, meeting rooms, meeting-room capacities and calendars" and "leadership and exec" locations.

Room bookings and executive calendars tell an insider where leadership will be and when. Limit that visibility to people who need it.

Unattended items are part of insider detection

On or about October 5, according to DOJ, he entered the room and appeared to look behind the television. Around the same time, security found a second recording device in a bag he had left unattended. Unattended-item procedures belong in insider detection, not only in safety plans.

The contractor badge lifecycle

The Navy case turns on a contractor credential. The U.S. Attorney's Office says the employee "obtained a credential that granted him access to portions of the naval base" and, from June to September 2024, allegedly photographed and filmed sensitive equipment and exercises and shared the images. He was charged with 14 misdemeanors. The FBI and NCIS are investigating.

Contractor badges need the same lifecycle as employee badges, and often a tighter one:

  • Access areas defined by the work, not by convenience.
  • Escorts for sensitive spaces.
  • Revocation at contract end or role change.
  • Periodic reconciliation of active contractor badges against active contracts.

The same governance applies to vendor remote access

A vendor's remote-access path is the digital contractor badge, and two failed this week.

Mandiant reports that ARMORY CASTLE, "a suspected PRC-nexus espionage threat actor," exploited a BeyondTrust Remote Support vulnerability as a zero-day "in late August 2026." According to Mandiant, the actor escalated to root and changed Jump Item permissions from "No Access" to "Administrator." CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16 and tells organizations to "rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts."

Separately, ConnectWise reported "unauthorized access to application identities associated with ConnectWise Cloud Backup." Todyl found sign-ins that used the app's client secret, and notes that "No user interaction was required, so user-focused controls such as MFA and conditional access for users did not apply." Huntress confirmed unauthorized sign-ins in 162 tenants and warns that disabling the apps "will not remove credentials that were already added." No source has attributed the ConnectWise activity.

In both cases, patching or disabling the vendor component is the start of cleanup, not the end.

The converged lens

A contractor may hold a facility badge, a remote-support account and an application credential at once, each approved by a different owner. When nobody owns the full picture, nobody owns revocation.

Treat third-party access, physical and logical, as one decision with one accountable owner and one review cycle.

What practitioners should do

  • Tier rooms, not just buildings, and review the logs.
  • Cover the approaches to sensitive rooms with cameras.
  • Restrict calendar and room visibility.
  • Reconcile contractor badges against contracts on a schedule.
  • Inventory vendor remote access and app identities, including tenant-wide permissions.
  • After a vendor compromise, rotate, revoke and hunt for credentials the compromised component added.

Bottom line

Each case this week ran through access someone had already granted: a badge, a room, a support appliance, an app secret. The question is the same every time: who holds the keys, what do they open, and who takes them back?

PSG Security Watch is published by Panoptic Security Group.

Sources: U.S. Department of Justice, https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai ; SecurityWeek (Associated Press), "Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say" (Oct 13), https://www.securityweek.com/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say/ ; U.S. Attorney's Office, Central District of California, https://www.justice.gov/usao-cdca/pr/camarillo-man-federally-charged-abusing-his-access-civilian-contractor-illegally-film ; FBI IC3, https://www.ic3.gov/PSA/2026/PSA261013 ; Mandiant/Google Threat Intelligence, https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust ; CISA, https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support ; ConnectWise, https://www.connectwise.com/company/trust/advisories ; Todyl, https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app ; Huntress, https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

‍