American spy hunters say there are four main ways adversaries try to recruit assets. This is summed up by the mnemonic “MICE” -- money, ideology, coercion, and ego. Former Nvidia CEO Jensen Huang probably had several of these working against him when he began his affair with alleged Chinese spy and Megaspeed executive Alice Huang. But Nvidia’s fallen CEO is not the only AI industry executive vulnerable to foreign intelligence operations. Many workers at frontier labs, chip firms, and other AI companies are equally exposed. After the Huang affair, policymakers and executives should stop wondering if American firms are compromised and start asking how.
Frontier labs have not always welcomed warnings about foreign influence. Consider the AI security researcher and wunderkind investor Leopold Aschenbrenner. He joined OpenAI in 2023 to work on the superalignment team. But he became troubled by the firm’s allegedly lax security, which he deemed “egregiously insufficient” to “protect against the theft of model weights or key algorithmic secrets from foreign actors.” After a major breach, Aschenbrenner brought a security memo he had written to OpenAI’s board, only to be reprimanded internally. “The HR person told me it was racist to worry about CCP [Chinese Communist Party] espionage and that it was unconstructive,” Aschenbrenner said, claiming he was eventually fired for this act.
Frontier labs have matured since 2023, but Silicon Valley remains genetically predisposed to thinking of risk as mainly a technical problem, something to be solved by teams of “cracked” engineers. Human errors are not so easily patched, and no amount of mandatory training can check the hubris of risk-seeking executives or disgruntled workers. A technical fix can be centrally deployed across systems, but human cooperation unfolds slowly, agent by agent, often guided only by loose social norms.
AI capabilities are advancing rapidly (some say too rapidly), but rooting out real and potential turncoats is still arduous work. A strong operational security or counterintelligence capability is a hard thing to make legible. How do you count the dogs that did not bark? When things are going well, these capabilities are easily overlooked, reduced, or dismissed. The dynamic resembles that of a psychiatric patient who rejects medication after growing accustomed to a sound mind. Many discount good security protocols until it is too late.
And “too late” is arriving ever faster and harder. The permanent contest between cyber offense and defense has become a Red Queen’s race, the competitive dynamic named after a character in Lewis Carroll’s Through the Looking-Glass. AI and cyber capabilities are now locked in a never-ending race between attackers and defenders. “It takes all the running you can do to keep in the same place,” the Red Queen tells Alice. Frontier models can now find zero-day vulnerabilities -- as Anthropic’s Mythos model did this past spring -- which can be used just as readily to defend or exploit. It all depends on who gets there first.
Repeats of the Huang affair are likely to turn up as the pace of change quickens and AI systems continue to scale. Industry and state secrets will likely become more lucrative, argues the economist Tyler Cowen. As machines harden, spies must go on the offense, looking for soft, fleshy parts to exploit. The defense will have a hard time catching them too. Operational security can be heavy on the bottom and light on the top. Lower-level workers are more likely to be vetted and terminated if they misstep. But the bigger targets at the top are harder to monitor and reprimand. Principals generally do not like agents talking back.
The forthcoming initial public offerings (IPOs) for Anthropic and OpenAI will further hasten this dynamic. Markets are hungry for new information, and they are astoundingly good at sorting it. In 1986, when the Challenger shuttle exploded shortly after lift-off, financial markets were able to find the firm responsible for the fragile O-ring within the hour. It took a government commission months to reach the same conclusion. For now, Anthropic and OpenAI both look well-placed to soak up any investor money flowing out of Nvidia. But in doing so they will invite enterprising short sellers to make bets that incentivize firms to improve their governance and better manage risks. This is just what Culper Research did when it bet against Nvidia back in May. At the time, the activist short-selling firm cited concerns about Megaspeed and Jensen Huang’s “uncomfortably close relationship” with Alice Huang, about half a year before the fall of the Nvidia CEO.
The dark arts of espionage, sabotage, and arbitrage will not fade as we stumble into the post-singularity world. We cannot seem to leave behind our love of money, ideology, coercion, and egoism -- the same traits that fuel conflict in the boardroom and war room alike. The political philosopher Thomas Hobbes had it right when he wrote in Leviathan that the “causes of quarrel” are principally “competition,” “diffidence,” and “glory.” The roots of conflict lie deep within our nature. They are not particular to any form of social organization. Even amid material abundance, we still find ways to make life “solitary, poor, nasty, brutish, and short.”
That is how Jensen Huang experiences the world: “To live on fumes at all times… [It’s] no different from the feeling I had this morning when I woke up: ‘You’re going to be out of business soon.’”
Huang ran his company frenetically, eager to expand or die -- the same “perpetual and restless desire,” as Hobbes said, “that ceaseth only in death.” Huang would never be content with just selling his era-defining GPUs to the West and its allies in the Indo-Pacific. He needed access to China’s vast market and growing demand for compute, even if he did not yet have enough advanced chips to meet Western orders. He was relentless in his mission to berate and intimidate all who refused him. He was afraid, hungry, and seemingly willing to do almost anything to get more.
But survival, for Huang, became indistinguishable from power and power from desire and desire from good. And what was good for Jensen was good for Nvidia, and what was good for Nvidia was good for America. There could be no limit. His paranoia became China’s opportunity and almost certainly Xi Jinping’s gain. But America’s AI industry need not wait around for the full counterintelligence case study. We can start by cultivating our own vigilance, our own situational awareness.