Where Does Technology Leakage Actually Come From? Reading METI's Second-Edition Guidance and Filling the AI-Agent Gap (2026)

Hello, this is Ryuta Hamamoto from TIMEWELL. I want to lay out where technology leakage actually comes from, in a shape that lets whoever owns the problem see the whole picture at once.

Say "technology leakage" and most people hear "export control." In practice, export control is one route among many. The engineer who resigns. The person you just hired. The networking gear sitting in your server room. The charging cable someone plugged in at an airport. And, increasingly, the AI agent. The technology you are protecting has not changed. The number of exits has.

This is the first article in a series, and its job is to draw the map. Each individual route already has a detailed article behind it, so I have linked them all from here. If you would rather start by finding out where your own organisation currently stands, there is a free three-minute export compliance self-assessment.

How the Japanese government frames the problem

Before inventing a framework of your own, look at the one the government has already built. On 27 April 2026, Japan's Ministry of Economy, Trade and Industry (METI) published the second edition of its Guidance on Countermeasures against Technology Leakage¹. It is owned by the Technology Investigation and Leakage Countermeasures Office within METI's Trade and Economic Security Bureau.

The second edition is organised into five chapters²:

1. Technology leakage countermeasures common to all chapters
2. Countermeasures associated with overseas expansion of production sites
3. Countermeasures against leakage through people
4. Countermeasures associated with joint research
5. Countermeasures associated with coordination and collaboration processes

The first edition, published in May 2025, rested on two pillars: overseas production sites and leakage through people. The second edition adds joint research and procurement/collaboration, and substantially expands the common measures and the people-related measures in light of the Economic Security Management Guidelines published in January 2026². On the people side, two items are new: aptitude checks when assigning someone to a department handling critical technology, and use of non-compete agreements to prevent leakage after departure.

This is a well-made, practical framework. My point is not that it is wrong. It is that it has not yet fully absorbed a situation in which AI agents and robots have become actors with access to confidential material. Government documents, by their nature, reflect practice that has already settled, so there is always a lag before new routes appear in them. That lag is precisely where the private sector can add something.

Breaking technology leakage into seven routes

Take the guidance's five chapters as the foundation, then re-sort them by the question practitioners actually ask: who, through what, can leak this? That gives you seven routes. Each already has its own article, so jump to whichever one you want to dig into.

#	Route	What happens	Read more
1	Export of goods and technology	Controlled goods or technology reach an entity of concern abroad without a licence	Export control violation case studies
2	Hiring	Someone is placed in a role with access to critical technology before their background and affiliations have been properly verified	Employment fraud and impersonation in the AI era
3	Current employees (deemed export)	Technology provided to a non-resident or specified-category person inside Japan turns out to be an export	Research integrity and deemed exports
4	Departing employees	An engineer with deep knowledge moves to a competitor or foreign institution, taking trade secrets along	Countering leakage by departing employees
5	Equipment and supply chain	The networking gear or endpoints you installed become the channel out	Routers and economic security, Regulatory moves on smart TVs
6	Physical carry-out	USB drives, charging cables, public Wi-Fi, stolen devices — the classic routes	The USB, cable and free-Wi-Fi traps
7	AI agents and robots	An AI follows instructions embedded in external data, or a robot's sensors record confidential material	Indirect prompt injection, Information leakage risk in physical AI

Routes 1 through 6 are the conventional ones the guidance covers. Route 7 is the new territory this article is trying to fill in.

What is actually happening on the conventional routes

People: seeing hiring through departure as one continuous line

In most organisations, hiring belongs to HR, access rights during employment belong to IT, offboarding belongs to general affairs, and export control belongs to the trade department. That division of labour is natural for an organisation. The problem is that it leaves nobody able to see, on a single page, which technologies a given person could reach, from when, and until when.

Deemed export management sits directly on top of this. Under the Foreign Exchange and Foreign Trade Act, providing technology to a non-resident counts as an export even inside Japan. A clarification issued in November 2021 extended this: even a resident is in scope if they fall into one of the "specified categories" of people under strong influence from a foreign government or foreign entity³. METI has gone as far as publishing an explanatory document aimed at newly hired employees⁴, which tells you plainly that this is meant to be checked at the point of hire.

On the departure side, the second-edition guidance points to non-compete agreements². But non-competes are not a cure-all. I have written about this in detail in the article on departing employees; the short version is that what really carries weight is not the contract binding them, but whether you kept a record of what they were able to see.

Equipment: the thing you bought was talking to the outside

In August 2026, security researchers published findings that firmware in twenty router models made by the Chinese vendor Zbtlink contained an implementation allowing remote root-level control (ENDLESSDOORS, CVE-2026-66747)⁵. According to the report, the function starts at boot and attempts to connect every 35 seconds to a fixed IP address and to a domain registered in China. Whoever controls that endpoint is described as being able to take over the router and, from there, reach other devices on the same network. The researchers estimate at least 100,000 units are running worldwide.

The vendor denies the presence of a backdoor. Its explanation is that the function exists for after-sales maintenance and is normally left only on sample units, to assist with debugging⁶.

That explanation does not square with the published facts. If it is only left on sample units, why was it found in the shipped firmware of twenty models? If it is a maintenance function, why does it need to call a fixed external address every 35 seconds, independent of anything the user does? Neither question has been answered. The vendor has also been reported as pausing firmware downloads to fix security issues, while continuing to deny the finding⁶. If there were nothing wrong, there would be nothing to pause. The explanation and the response do not line up.

I am not going to assert here that this was a deliberate backdoor. The investigation is ongoing, and settling that question is a job for investigators and regulators, not for me. But the operational decision is a separate matter. With no fixed firmware available, changing passwords or factory-resetting does not close this out. The researchers themselves urge organisations to identify affected models, isolate them, and plan on the basis of replacement⁵. Choosing to wait for a verdict on intent is the same as choosing to stay exposed for the entire length of the wait.

There is one more easily missed detail. The vendor also does OEM/ODM manufacturing, and the report notes that equipment sold under other brand names may contain the same implementation⁵. In other words, confirming "we do not buy from that company" is not enough. You need to be able to trace procured equipment back to who actually manufactured it — structurally the same problem as establishing country of origin in export control.

AI agents and robots: a new class of actor

Here is where we step outside the guidance.

Technology leakage countermeasures have, until now, been designed on an unspoken premise: the thing that leaks is a person. You hire people, train them, grant them rights, bind them with contracts, and collect it all back when they leave. Push routes 1 through 6 far enough and every one of them is ultimately about managing human behaviour.

AI agents and robots are not people, yet they behave like them. They read internal documents, make judgements, communicate externally, and move through physical space seeing and hearing things. The set of actors with access to confidential material has grown beyond people, while the management framework still assumes people. That is where we are.

Concretely, at least three things do not fit the existing frame.

The first is indirect prompt injection. When instructions are planted inside external data an AI agent reads, say an email or a shared document, the AI cannot reliably distinguish them from the user's own instructions, and follows them. CVE-2025-32711, published in 2025, is a well-known demonstration that confidential information can be exfiltrated this way⁷. The awkward part is that the attacker never needs to breach your network. Leaving text somewhere the AI will go and read is enough. I covered the mechanics in a dedicated article.

The second is credentials and environment variables. Getting an AI agent to do useful work usually means handing it API keys and access tokens. A person understands "do not repeat this outside the company." An agent cannot always correctly identify where an instruction came from. Granting minimum privileges with short lifetimes — entirely ordinary design — matters more here than it does with people.

The third is physical AI. Delivery robots, security robots, humanoids, and equipment carrying sensors and cameras move through factories and labs recording their surroundings. Where does that footage go, where is it stored, and who trains on it? If you have not nailed that down in contracts and configuration, you effectively have something person-shaped walking your corridors without a badge. I go deeper in a separate article.

My read is that all three will eventually be folded into government guidance. There is no reason to wait for that, because the work is an extension of what you already have: add non-humans to the inventory of actors. Add rows for AI agents and robots to the list of who can reach confidential material. Set privileges, expiry dates, and logging for each. Apply what you already apply to people.

Why the human entry point comes first

Lay out seven routes and it is hard to know where to begin. I would start at the human entry point: hiring, and counterparty verification. Two reasons.

First, it is the one you cannot undo. Equipment can be swapped out. An AI agent's privileges can be tightened today. But you cannot retrieve what someone who held a role with access to critical technology remembers after they leave. The second-edition guidance added aptitude checks at assignment for what I assume is the same reason².

Second, this verification is almost the same work as export control itself. Is the counterparty on a restricted list? What capital sits behind them? Who ultimately receives the technology? The screening you already do for export control and the checks you run when bringing someone in draw on the same sources and follow the same shape of reasoning. There is no need to build two separate machines.

TRAFEED, which we develop, was originally built as an AI agent for export control classification and counterparty screening. Watching how it gets used, though, what it really functions as is a checkpoint for deciding whether information can go out. It screens across multiple jurisdictions' restricted-party lists, traces ownership chains, and keeps the rationale for each decision on record. That last part is what does the work for technology leakage: it puts you in a position to explain, later, why you decided what you decided.

Classification accuracy is above 95% (joint validation with Okayama University; our own study), the classification method is patented (Japanese Patent No. 7862062), and more than 20 organisations use it. To be explicit: the final determination belongs to your export control officer, and the AI's job is to assemble the material and the supporting evidence. In a compliance function, the judgement itself should not be handed to a machine. Details are on the TRAFEED page.

If you want to share the whole picture internally: we distribute a product catalog setting out what TRAFEED screens, how far it automates, and where the human takes over. Beyond the export control team, it works as a document for getting HR, procurement and IT onto the same page about there being seven routes, not one. → Download the TRAFEED product catalog (free; company name and work email required)

Summary, and what comes next

• Technology leakage is not only export control. There are at least seven routes
• The current government framework is METI's Guidance on Countermeasures against Technology Leakage, Second Edition (April 2026), in five chapters. Building on it is the right starting move¹
• The guidance is designed around people as the actor, and has not yet fully absorbed AI agents and robots as a new class of actor
• Three things need adding: indirect prompt injection, credentials handed to agents, and what physical AI records
• Start at the human entry point. It is the part you cannot undo, and it takes the same work you already do for export control

The rest of the series:

• Part 2: The human breakwater against technology leakage — connecting hiring, assignment, employment and departure using the deemed-export specified categories and the three requirements for trade secrets
• Part 3: How to implement technology leakage countermeasures in an organisation — no new organisation; use the export control internal compliance programme as the vessel, all the way through to AI agents

If you would rather establish your own baseline first, try the free export compliance self-assessment. For help designing the structure itself, book a consultation.

References

Footnotes

1. METI, "Guidance on Countermeasures against Technology Leakage, Second Edition, Compiled" (published 27 April 2026). https://www.meti.go.jp/press/2026/04/20260427002/20260427002.html ↩ ↩²

2. METI, Trade and Economic Security Bureau, Technology Investigation and Leakage Countermeasures Office, "Guidance on Countermeasures against Technology Leakage, Second Edition" (April 2026). https://www.meti.go.jp/press/2026/04/20260427002/20260427002-1.pdf ↩ ↩² ↩³ ↩⁴

3. METI, "Security Export Control: Deemed Export Management." https://www.meti.go.jp/policy/anpo/anpo07.html ↩

4. METI, Trade Control Department, "Clarification of 'Deemed Export' Management (For Newly Hired Employees)" (November 2021). https://www.meti.go.jp/policy/anpo/law_document/minashi/jp_kigyou.pdf ↩

5. VulnCheck, "ENDLESSDOORS: Zbtlink Router Backdoor" (CVE-2026-66747, published August 2026; confirmed in the firmware of 20 models, with an estimated 100,000+ units in operation). ↩ ↩² ↩³

6. The Register, "Chinese router vendor denies its firmware contains backdoors – but pauses downloads to fix security issues anyway" (6 August 2026; includes the vendor's rebuttal and response). https://www.theregister.com/security/2026/08/06/chinese_router_vendor_denies_its/ ↩ ↩²

7. CVE-2025-32711 (a case of information disclosure via indirect prompt injection; see our dedicated article for detail). https://nvd.nist.gov/vuln/detail/CVE-2025-32711 ↩