Redbot Labs / Threat Intelligence
SEC Attorney Sends Whistleblower Information to Unauthorized AI Transcription Service
- Incident ID
- RBT-TI-0081
- Organization
- U.S. Securities and Exchange Commission
- Reported Location
- Salt Lake City, Utah, United States
- Severity
- High
- Category
- AI Data Exposure / Unauthorized AI Use
- Record Date
- 2026-03-25
Incident Summary
The U.S. Securities and Exchange Commission Office of Inspector General found that a former SEC attorney secretly recorded an interview with an SEC whistleblower and used an unauthorized third-party artificial intelligence recording and transcription service to process the conversation.
The attorney did not inform or obtain consent from the whistleblower, the whistleblower's attorney, or another SEC attorney participating in the interview.
The OIG further determined that SEC nonpublic information was transmitted to the unauthorized AI application using the attorney's personal email account.
The same unauthorized AI service was also used to produce additional recordings believed to be associated with SEC work.
The attorney resigned from federal service before the OIG investigation and declined to be interviewed.
What Happened
The SEC Office of Inspector General investigated whether an attorney working in the SEC’s Salt Lake Regional Office secretly recorded an interview conducted with an SEC whistleblower.
The OIG found that the attorney audio-recorded the interview without notifying or obtaining consent from the whistleblower, the whistleblower’s attorney, or another SEC attorney participating in the meeting.
The attorney then used an unauthorized third-party AI recording and transcription application to process the interview and create a transcript.
Investigators determined that the attorney transmitted SEC nonpublic information to the unauthorized AI service through a personal email account.
The OIG also found that the same AI application had been used to create additional recordings, some of which were believed to relate to SEC work.
The employee resigned from federal service before the OIG investigation and declined to provide an interview or statement.
The OIG referred the matter to the U.S. Attorney’s Office for the District of Utah, which declined prosecution, and subsequently referred the findings to the SEC for information.
Affected Systems
SEC Nonpublic Information / Whistleblower Interview Records / Unauthorized AI Transcription Service / Personal Email Account
Attack Vector
Unauthorized AI Use / Personal Email Transfer / Sensitive Data Exposure
Business Impact
The incident caused sensitive SEC nonpublic information associated with a whistleblower interview to cross the agency’s approved information-processing boundary and enter an unauthorized third-party AI service.
Whistleblower information can be particularly sensitive because disclosure may expose identities, allegations, investigative details, legal strategy, or other nonpublic enforcement information.
Use of a personal email account further removed the information from normal SEC governance, monitoring, retention, and access-control mechanisms.
The OIG also identified additional recordings believed to relate to SEC work, indicating that the unauthorized AI use was not necessarily limited to a single interaction.
The public OIG findings do not establish that an outside malicious actor subsequently accessed or misused the information. The supported impact is therefore unauthorized AI processing and exposure of SEC nonpublic information rather than confirmed external theft or exfiltration.
Redbot Analysis
The SEC incident demonstrates that enterprise AI exposure does not require a software vulnerability, external attacker, or malicious prompt.
A user with legitimate access to sensitive information can create a security incident simply by moving that information into an unapproved AI processing environment.
AI transcription services create particular risk because they can transform ephemeral spoken conversations into persistent, searchable records stored and processed by an external provider.
That risk becomes more significant when the underlying conversation contains whistleblower information, legal matters, investigative details, regulated data, customer information, intellectual property, or other sensitive enterprise content.
The incident also illustrates why AI governance must extend beyond access to public chatbots.
Organizations should account for AI meeting assistants, transcription tools, browser extensions, document assistants, coding tools, plugins, and other services capable of receiving enterprise information.
Controls should combine approved-AI policies with technical enforcement, data-loss prevention, endpoint controls, identity restrictions, SaaS discovery, logging, and employee education.
The use of a personal email account in this incident further demonstrates how unauthorized AI adoption can intersect with conventional shadow-IT and data-governance failures.
Redbot Labs assesses unauthorized AI processing as an increasingly important enterprise attack surface because AI services can create new copies, transcripts, embeddings, summaries, and derived data outside the organization’s intended security boundary.
