A security executive who works with artificial intelligence developers and the intelligence community says there are likely more spies at AI companies than the public record shows, according to reporting by The Information. The outlet identifies her as Lisa Thiergart, co-founder and chief executive of Security Level 5, a startup that works to secure AI data centers.
A separate post from The Information says Thiergart described spies as already working inside AI companies. The same reporting carries a second judgment that has drawn less attention than the headline: other countries have likely not yet stolen AI models from leading U.S. companies, though they may have tried.
Who Lisa Thiergart Is and What Security Level 5 Does
The Information describes Thiergart as co-founder and CEO of Security Level 5 and says the company works with AI developers and the intelligence community to harden AI data centers. The technology site shattered.io, which reviewed the reporting, called that pairing unusual: most security vendors sell to one side of the house, either commercial buyers or government. A firm sitting between the two, shattered.io wrote, is betting that frontier AI labs now face threats that look more like national-security problems than ordinary enterprise risk.
Public footprints place Thiergart in the AI safety and security research community. According to shattered.io, the MATS research program lists a stream page titled for Thiergart and Luis Cosio, tagged SL5 Task Force, for its Autumn 2026 cohort, and the Foresight Institute carries a 2026 page for Lisa Thiergart in its grantees section. Neither page describes an espionage case, shattered.io said.
The name of the venture is inconsistent across sources. The Information uses Security Level 5, while other pages use Security Level Five or SL5 Task Force. shattered.io said it uses Security Level 5 because that is the exact wording in the report that started the story, and treats the variants as unresolved until a company page or filing settles the question. The top-tier label implies a scale with levels beneath it, a common way to describe security maturity.
A Split Verdict on Spies at AI Companies
Taken together, the two halves of the report read as a split verdict, shattered.io wrote: the threat is live and the people are reportedly inside, but the big prize, a frontier model’s weights, has probably not walked out the door yet.
No spy, country, company, stolen model or date is named in the reporting. shattered.io characterized the account as a risk assessment from someone whose business depends on that risk being taken seriously, and noted that the story rests on one executive’s judgment relayed by one outlet. Thiergart works near the intelligence community, which the site said gives her view some weight, but a judgment about prevalence is not a count, and no count has been offered. The word “likely” is retained because the report uses it.
shattered.io also argued that an assertion that spies are present is close to unfalsifiable from the outside, because no company will publish a list of detected intrusions and no government will confirm sources and methods. Silence, it wrote, looks the same whether the threat is real or exaggerated, which makes the more useful question not whether a spy exists but whether a lab’s controls would catch one. More NarwhalTV technology and security coverage follows the same debate.
Why Model Weights Are a Different Kind of Secret
shattered.io explained why security specialists treat AI labs differently from other corporate targets. A trained model’s weights are the file-sized result of an enormous compute bill, and whoever holds them can run the model, fine-tune it and strip out guardrails without repeating the training run. A stolen customer list loses value as it ages; a stolen frontier model can keep working for as long as it stays near the state of the art, the site wrote.
The economics, by that account, point one way. Training a leading model costs far more than a determined state-backed team would spend on an intrusion campaign or a recruitment effort, an asymmetry shattered.io said explains why security people now discuss AI labs the way they once discussed defense contractors. The reported view from The Information, that rivals likely have not yet stolen models but may have tried, fits that logic: an attempt costs little, while a success is worth a great deal.
Beyond model weights, shattered.io noted a second layer of value. Training data pipelines, evaluation suites, safety research and unreleased architecture notes all offer a competitor a shortcut, and a spy placed on the right team would not need to exfiltrate a multi-hundred-gigabyte file to do damage.
The Insider Problem Network Defenses Miss
The framing in the Thiergart report places the threat inside the building, with badges, laptops and legitimate access, shattered.io wrote, which is a different problem from a remote hacker probing a firewall. Network defenses do little against a person who is allowed to open the file.
Insider cases tend to look mundane, the site said: an engineer copies a repository to a personal device before leaving for a competitor, a contractor with broad read access photographs a screen, or a recruited employee passes along answers to narrow technical questions over months. None of that triggers alarms built to catch malware. Security teams catch it, when they do, through access logging, least-privilege design and human reporting.
Defenders face a hard trade-off. Labs hire fast, pay well and rely on open research culture to attract talent, and researchers expect to share ideas, publish and move between organizations, all of which widen the surface area a security team would normally want narrow.
Distillation as a Route That Needs No Spy
Stealing weights is not the only path to a competitor’s capabilities, shattered.io noted. Distillation, the practice of querying a strong model at scale and training a smaller one on its outputs, lets an outsider capture much of a model’s behavior through the front door, requiring only an API account and a budget. Labs that sell API access are inviting the very queries that make extraction possible, the site wrote, and rate limits, usage monitoring and terms of service are policy tools rather than physical barriers.
Building AI Data Centers for State-Level Adversaries
Security Level 5 describes its work as securing AI data centers, and shattered.io said the framing is deliberate. Standard commercial facilities optimize for uptime, density and cost, and assume the tenant is trusted and the outside world hostile. A facility built to resist a state-level adversary has to assume that some tenants, staff and supply-chain components may be hostile too.
That assumption changes the design, the site wrote: access controls tighten so fewer people can touch the systems holding weights, hardware provenance receives scrutiny because a compromised component can leak data below the level where software defenses operate, and monitoring shifts from catching known bad behavior to flagging anything unusual. Each measure adds cost and friction, and each slows research teams that want fast iteration.
