Leaks, whistleblowers. Some circumstantial evidence will also do if there's enough of it. Like having hallucinated parts of code that do absolutely nothing, and can't be explained as e.g. leftovers from a refactor.