AI Weekly Malaysia

A terminated employee at a 1,000+ person company retained active credentials for several days because HR and IT each assumed the other would revoke access. The ex-employee deleted files, locked out other accounts, and corrupted a database, causing hundreds of thousands of dollars in damage and weeks of project delay. Recovery was slow because the person who damaged the systems knew them best.

Why: If you run a startup or small team, assign a single named owner for credential revocation on termination day and enforce shared-admin-credential rotation as part of offboarding. The failure here wasn't a hack—it was a gap between HR and IT where nobody was responsible, and shared admin credentials meant one person's departure cascaded across multiple systems.

Apple filed new evidence in its lawsuit against OpenAI, alleging former employee Chang Liu used a confidential Apple circuit schematic and an internal Apple engineering tool at OpenAI. Apple also claims Liu enlisted OpenAI colleague Yu-Ting Peng to destroy evidence in June, and that Liu's continued access to Apple systems came from exploiting a 'rare, previously unknown authentication bug' rather than routine offboarding failures as OpenAI contends.

Why: The dispute highlights a concrete offboarding failure worth noting: Liu allegedly retained access to Apple files after leaving, and the two sides disagree on whether this was a standard deprovisioning lapse or an exploited auth bug. If you run a SaaS or manage employee departures, this is a reminder that residual access to internal tools and schematics can become litigation fodder, not just a security gap.