Chinese hackers impersonated an Anthropic exec to get information about AI

CNN | Sean Lyngaas

Suspected Chinese state-aligned cyber operatives targeted American artificial intelligence experts in February and July 2026 using sophisticated social engineering campaigns. Discovered by cybersecurity firm Proofpoint, the espionage campaign targeted researchers at US universities, think tanks, and law firms to gain critical insights into American AI policy, export controls, and military applications.

These operations exploit the growing geopolitical friction surrounding advanced technology governance and bilateral trade restrictions. The hackers impersonated former White House technology official Lynne Parker and an Anthropic executive. They sent malware-laced documents and phishing emails, including a fake inquiry regarding the military integration of the Claude AI model. This occurred just before the Trump administration ordered federal agencies to cease business with Anthropic. Security remains paramount. While Proofpoint found no evidence of successful breaches, the persistent targeting reveals Beijing's intent to bypass US export controls and accelerate its own domestic capabilities. This activity mirrors broader efforts to acquire Western technological expertise.

Comment

The targeting of US policy analysts by Chinese cyber actors reveals a shift in intelligence collection priorities toward the cognitive and regulatory dimensions of technology competition. Rather than focusing solely on stealing source code, Beijing seeks to map the decision-making frameworks governing American export controls and military technology integration. This focus on the policy ecosystem suggests that understanding the regulatory boundaries of systems like Anthropic's Claude is as valuable to foreign intelligence services as the underlying algorithms.

The operational mechanism relies on highly tailored spear-phishing that exploits established professional relationships within the Washington policy community. By impersonating trusted figures like Lynne Parker, the threat actors bypass traditional technical defences through social engineering. Proofpoint's identification of these credential-harvesting attempts indicates that human-centric vulnerability remains the primary vector for accessing sensitive discussions on Claude's military utility.

Strategic Question for Discussion

If Beijing's intelligence focus shifts from stealing source code to mapping the policy frameworks of systems like Anthropic's Claude, how does this alter the threat model for non-governmental policy institutions?

The pattern suggests that think tanks and academic institutions will increasingly be treated as primary intelligence targets rather than secondary bystanders in technology competition. This trajectory indicates that securing the intellectual pipeline of AI policy is now as critical as protecting the physical supply chains of semiconductors. Non-governmental organizations are likely to face heightened exposure to state-sponsored social engineering targeting their research on Claude's dual-use capabilities.

Share your assessment in the comments below.

To read in details click here