Insider Threat Communications: The OpenAI Statement

Insider threat communications before a trial should state what the company observed and did, and leave guilt and motive to the court. On October 13, 2026, the U.S. Justice Department announced that an OpenAI engineer was charged with using a device to intercept oral communications in an executive conference room. The charge is an allegation, and OpenAI described its own steps without asserting how the case will end.

What did OpenAI and the Justice Department say, and when?

The public record so far is a short sequence of dates drawn from the Justice Department's announcement and OpenAI's statement. The table below lists each step and the outlet reporting it.

The charge, as CBS News reported it, is attempting to use an electronic, mechanical or other device to intercept oral communications. OpenAI told reporters that it referred the matter to the FBI and that it took gradual steps to contain the risk while the investigation continued.

Which claims can a company make before a trial?

A company can safely state three kinds of claim before a trial: what its own staff observed, what actions it took, and what it knows about its own exposure as of a stated date. It should not state a fourth kind, which is anything the court has not decided. The table below sorts the claims in this case.

The separation matters because an employment decision is not a verdict. A termination tells employees what the company did about its own risk, and the statement should say so in those terms. EPR's litigation PR guide covers the limits that legal rules place on public statements about pending cases.

How can a company reassure employees without implying surveillance?

A company can reassure employees by naming the specific control that found the problem and saying what that control covered. In this case The National reported that the device was found during a sweep of a conference room, which is a physical security check, not a review of employee messages.

OpenAI also said it used its own AI models to help investigate the device and its origin, according to Tech Times. A statement like that invites a question from staff: what else do those tools see? The answer belongs in the same message. Illustrative scenario: "The investigation used building access records and device inspection. It did not involve reading employee messages." The sentence is only usable if it is true, which is why legal and security leads need to approve it before it is sent.

What do customers and investors need to hear?

Customers and investors need to hear what was and was not affected, with a date attached. The National reported that OpenAI confirmed no model weights, source code or customer data were compromised, and that its investigation remained ongoing.

That statement has the same shape as the "no indication" language in data breach communications. It describes the state of the investigation today, and audiences hear it as permanent. EPR's analysis of multi-brand crisis communication covers why a reassurance needs a stated scope, a date and a place where corrections will be posted. A company that publishes those three things can update later without appearing to retreat. The data breach communications archive shows how earlier companies handled the same problem.

What should the statement leave out?

The statement should leave out anything that adds heat without adding information about the company's response. Four omissions cover most of the risk.

1. The accused person's name, unless a court record already makes it unavoidable and counsel agrees.
2. Personal characteristics of the accused, such as nationality, which say nothing about the company's actions and can attach a stereotype to a whole group of employees.
3. Speculation about motive, sponsors or other participants.
4. Words that assert the outcome, such as "spy" or "guilty," in any channel including internal chat.

Internal messages carry the same risk as the press statement, because a screenshot of an all-staff note reaches the same audience. OpenAI's earlier public communications are examined in EPR's piece on how OpenAI does PR, which gives context for how the company usually handles questions about its operations.

What should the all-staff message say?

The all-staff message should reach employees before or at the same time as the press statement, because employees are the first audience that will be asked about the case. It should be shorter than the public statement and written in plain sentences.

Illustrative scenario: "Our security team found an unauthorized recording device in a meeting room and reported it to law enforcement. An employee has been charged. A charge is an allegation, and we will not discuss the case while it is pending. If you have information, contact security. If you have questions about how we protect meetings, ask your manager."

Three features make that message work. It states what happened in neutral terms. It says what the company will not discuss and why. It gives staff one place to take questions. Managers need the same text, plus a short list of questions to refer to security or legal, so no one improvises an answer about the accused.

The press statement and the all-staff message should be reviewed side by side before release. Any sentence that appears in one and not the other needs a reason. A fact that employees first hear from reporters, or a claim that differs between the two documents, is the likeliest source of a second news cycle after the first one has settled. Legal and security should approve both versions.

Conclusion

An insider-threat statement before a trial has one job: report what the company saw, what it did and what it can say about its exposure today, and stop there. The court decides the rest, and a statement limited to those three claims is easier to update if the facts change.