The person who was bugged, brought the bug into the embassy via the bag. Probably some generic item was modified to contain the spy gear and then supplied to the person. I don't think the person brought it into the secure area intentionally.