Take a look at the CVEs. People find vulnerabilities in trusted open source projects all the time. The NSA hires a lot of smart people to spend all day looking for them and <i>not</i> share their findings with the Internet.<p>No infiltration required.