They coast for a while on passable work but it isn't sustained through multiple warnings. The day after we hit him with a PIP he performed a mass exfiltration.

Two weeks after we let him go, systems he had previously had access to were compromised from outside.

With remote workers, if they start underperforming, start revoking whatever access you can at the first warning. Most of the events were set in motion once he saw the writing on the wall. This one was a textbook case with such predictable timing it's absurd that he got as far as he did.

He also raised every red flag in the book during the hiring process (interviewers noted suspicions of AI use) and presented as too good to be true with perfect skills alignment and low salary requirements. At every point in the process we knew better.

Employing a North Korean can create sanctions and criminal risk, so it's not worth it.

From what I've heard from people who have accidentally hired them though, many are great engineers.