Comment by totetsu

it says "according to four Department of Homeland Security officials with knowledge of the incident." and "according to the four officials, each of whom was granted anonymity for fear of retribution." .. so It seems to be an internal lead.

as the post above says.. on managed devices, there can be an enforced vpn, that monitors all traffic coming and going, and while its at it, strip out the encryption and look inside the packets, and apply heuristics like .. what is the host domain, is it from a known LLM site.. and is its a POST message sending data, and then does the text of that data have a string matching "INTERNAL USE ONLY". I assume something like this.