The rivalry between the United States and China over artificial intelligence is no longer just about advanced chips, computing power or who can build the most capable AI models. Cybersecurity has become another major part of the contest, with Washington raising concerns about attempts to access sensitive technology, gather intelligence on US AI policy and exploit digital infrastructure.
Several recent developments have brought those concerns into focus. On 8 October, the US Department of Justice and FBI announced court-authorised action against two tools allegedly used by China-linked hackers to scan networks and support cyber intrusions. Earlier in October, cybersecurity researchers reported phishing campaigns targeting US AI policy experts. In September, US security agencies also warned of what they described as industrial-scale efforts by China-based companies to extract capabilities from American frontier AI models.
Taken together, these developments show how the AI race is becoming increasingly connected to cyber espionage, intellectual property and national security. The competition is no longer limited to building better models. It also involves protecting the systems behind them, safeguarding sensitive research and preventing rivals from gaining access to valuable technical or strategic information.
Still, the evidence needs to be considered carefully. The reported incidents do not establish that every cyber operation is directed by the Chinese government, nor do they prove that Washington and Beijing are engaged in a formally declared AI cyberwar. What they do show is that advanced technology has become an increasingly attractive target, and that both countries have strong reasons to treat its security as a strategic priority.
WASHINGTON MOVES AGAINST A CHINA-LINKED CYBER NETWORK
On 8 October, the US Department of Justice and FBI announced the seizure of infrastructure associated with two tools known as Microscan and FishHub.
According to US authorities, the tools were operated and used by actors associated with Integrity Technology Group, a China-based company that has held Chinese government contracts. The company has also been linked by US authorities to the Flax Typhoon cyber activity cluster. The allegations were detailed in court documents, and the operation aimed to disrupt infrastructure allegedly used in attacks against networks in the United States and other countries.
Microscan was allegedly used to scan computer networks for vulnerabilities. FishHub, meanwhile, was described as a tool that could support targeted phishing campaigns and help attackers deliver additional malware or gain unauthorised remote access after compromising a network.
The alleged targets included more than government offices. US authorities identified a power company, airports in Japan and Poland, Taiwanese energy-sector infrastructure, universities and other organisations among those exposed to scanning or intrusion activity. The Justice Department also said that approximately 20 Taiwanese universities were confirmed victims of FishHub activity.
The case highlights how cyber operations often rely on a network of supporting tools, compromised devices, domains and other infrastructure. Disrupting one part of that system can make an operation harder to sustain, although it does not necessarily eliminate the people or capabilities behind it.
There is also an important distinction here: the government announcement did not establish that Microscan or FishHub were powered by artificial intelligence. The case is relevant to the wider security concerns surrounding the AI race, but it should not be presented as proof that autonomous AI agents carried out these particular attacks.
AI RESEARCHERS AND POLICY EXPERTS FACE GROWING SECURITY RISKS
The competition is also playing out through efforts to obtain information about AI research, regulation and government strategy.
A report published by Cybersecurity Dive on 1 October, citing cybersecurity firm Proofpoint, described credential-phishing campaigns aimed at US AI policy experts and prominent economists. Researchers attributed the activity to a China-linked espionage actor tracked as TA419. According to the report, the actor impersonated recognised figures and sent messages inviting recipients to participate in discussions about AI policy.
The reported campaign included attempts to impersonate former US government officials and an employee of AI company Anthropic. Researchers said the attackers used techniques designed to capture login credentials, including an adversary-in-the-middle phishing method targeting Microsoft 365 and Entra ID accounts.
Why target policy experts? Their email accounts can contain far more than routine correspondence. They may include discussions with government officials, draft policy recommendations, meeting details and early information about proposed regulatory decisions. Access to these communications could offer valuable insight into Washington's plans for advanced AI, technology controls and industry oversight.
However, the report did not establish that every attempted attack succeeded. Proofpoint said it was not aware of successful compromises among the organisations covered by its findings, although it could not rule out activity outside its visibility.
That distinction matters. A targeted phishing campaign can indicate a serious intelligence-gathering effort even when there is no confirmed evidence of stolen credentials or compromised accounts. An attempted intrusion, a successful account takeover and verified data theft are different outcomes.
For AI developers, researchers and policymakers, the lesson is clear: protecting source code and computing infrastructure is not enough. The people involved in developing and regulating the technology also need strong security measures.
THE DISPUTE OVER AI MODEL DISTILLATION
Another major point of tension concerns the knowledge and capabilities built into advanced AI models.
On 8 September, the US National Security Agency, FBI and Cybersecurity and Infrastructure Security Agency issued an advisory alleging that China-based AI companies were conducting industrial-scale distillation campaigns against US frontier models. The agencies said these efforts sought to extract restricted proprietary capabilities and use them to train competing systems.
Model distillation itself is a standard machine-learning technique. Developers can use the outputs of a more capable model to train a smaller or more specialised system, potentially improving its performance and efficiency. The controversy is not about whether distillation is inherently improper. It is about how the information is obtained, whether access restrictions are bypassed and whether proprietary capabilities are extracted without permission.
US agencies alleged that some operations used multiple model providers, cloud platforms and supporting infrastructure in ways that could make the activity harder to detect. They warned that such efforts could help competing systems narrow the performance gap without bearing all the costs associated with developing advanced models independently.
These are serious allegations, but they remain allegations made by US agencies. The advisory does not establish that all Chinese AI development relies on improperly obtained capabilities, nor does it make legitimate research collaboration or the use of open-source techniques equivalent to unauthorised extraction.
The economic stakes are substantial. Building advanced AI systems requires significant investment in computing resources, data, engineering and research. If a company can reproduce valuable capabilities by extracting information from a competitor's model without authorisation, the original developer may lose part of the advantage created by that investment.
As a result, AI companies are paying closer attention to API access, unusual usage patterns, model protection and attempts to reproduce restricted functionality. The challenge is to protect legitimate commercial interests without treating every intensive use of an AI service as evidence of wrongdoing.
WHY CYBERSPACE HAS BECOME A STRATEGIC BATTLEGROUND
AI offers potential advantages in national security. It can help analysts process large amounts of information, identify patterns and speed up certain technical tasks. But similar capabilities can also be misused to search for vulnerabilities, automate reconnaissance or support malicious cyber activity.
That creates several overlapping security challenges.
Protecting critical infrastructure
Energy networks, telecommunications systems, transport infrastructure and government services all depend on interconnected digital networks. Access to these systems can provide intelligence during peacetime and potentially create opportunities for disruption during a crisis.
A recent Council on Foreign Relations report warned that Chinese cyber capabilities and persistent access to critical infrastructure pose a significant challenge to US resilience. It called for better visibility into cyber campaigns, stronger network protection and more credible ways to impose costs on malicious activity.
Securing AI research and development
Advanced models, training environments, proprietary datasets and computing infrastructure have become valuable targets. A successful intrusion could expose research, disrupt development or reveal a company's future technical plans.
Strengthening cyber defence
AI can help security teams sort through alerts, identify unusual activity and prioritise investigations. However, these benefits depend on reliable data, careful implementation and appropriate safeguards. An AI system with excessive permissions can create vulnerabilities of its own.
Protecting sensitive policy information
Information about export controls, military applications, regulatory plans and government priorities can be valuable to a rival. Attempts to access the accounts of AI researchers and policy experts may therefore serve a wider intelligence-gathering purpose, even when those individuals do not work directly for the government.
These threats are connected, but they are not interchangeable. Cyber espionage, intellectual-property theft, attacks on critical infrastructure and military applications of AI involve different objectives, legal questions and levels of risk.
THE MILITARY RISK: HOW A CYBER INCIDENT COULD ESCALATE
The greatest danger may not come from a single cyberattack. It could emerge when a serious incident occurs during a political or military crisis and officials cannot quickly determine who is responsible or what has happened.
In September, Reuters reported on recommendations from US and Chinese security experts who called for safeguards against the risks posed by increasingly capable AI systems. Their proposals included clear boundaries around nuclear systems, human control over consequential cyber operations and a communication channel for serious AI-related incidents.
The concern is practical. If an AI-enabled operation interfered with a military communications network or a system connected to nuclear command, officials could have very little time to determine whether the incident was accidental, criminal or state-directed.
Automated systems may accelerate technical operations, but they cannot reliably establish political intent. A system might detect suspicious activity without knowing whether it resulted from an authorised exercise, a technical malfunction or a deliberate attack.
In an already tense confrontation, that uncertainty could make matters worse. Governments might feel pressure to respond before the facts are clear, while delays could create fears that an adversary is gaining an advantage.
The proposals reported by Reuters do not constitute a binding agreement between Washington and Beijing. They reflect growing concern among experts that practical safeguards and communication channels should be established before a serious incident forces governments to make decisions under pressure.
THE AI RACE ALSO DEPENDS ON TECHNOLOGY SUPPLY CHAINS
Cybersecurity is only one part of the wider US–China AI competition. Access to advanced chips, computing infrastructure, software and cloud services also influences each country's ability to develop increasingly capable systems.
A bulletin published by the Institute for China-America Studies on 7 October highlighted reporting that suggested the performance gap between leading US and Chinese AI models had narrowed. It also discussed efforts by Chinese developers to reduce their dependence on US technology, including work on alternative software for Huawei's Ascend chips.
These developments show why cybersecurity and industrial policy are becoming increasingly intertwined. Countries that can protect their research, safeguard intellectual property and maintain access to computing resources may be better positioned to sustain their AI programmes.
At the same time, restrictions on technology transfers can encourage domestic alternatives and deepen mistrust between competing technology ecosystems. Governments must balance the need to protect sensitive capabilities against the risk of unnecessarily fragmenting research, commercial markets and international cooperation.
The supply chain adds another layer of complexity. Companies must secure their own systems while assessing the risks associated with cloud providers, software dependencies, contractors and research partners. A weakness in one part of the chain can expose valuable information elsewhere.
For US companies, immediate priorities include protecting model access, monitoring suspicious extraction attempts and securing employee accounts. Chinese companies operating internationally also face the need to demonstrate credible security practices and comply with applicable legal and contractual requirements.
Ultimately, a country's AI position depends on more than the performance of its models. It also depends on the security and reliability of the infrastructure supporting them.
WHAT BOTH SIDES NEED TO GET RIGHT
An intensifying technology rivalry can encourage stronger security, but it can also lead to dangerous assumptions.
The first risk is treating every technical incident as a state-directed operation. Cyber attribution is difficult, and the broader ecosystem can include intelligence services, contractors, criminal groups and independent actors. Governments need to distinguish clearly between allegations, intelligence assessments and confirmed findings.
The second risk is assuming that AI alone will give one country a decisive advantage. Models are only one part of cyber capability. Access to networks, infrastructure, intelligence, skilled personnel, operational discipline and defensive resilience all play a role.
The third is allowing competition to shut down communication channels. Even strategic rivals share an interest in preventing an ambiguous cyber incident from triggering a wider military confrontation.
Finally, governments and companies need to treat AI security as part of a much broader cybersecurity effort. Protecting a model while leaving employee accounts, cloud environments or connected infrastructure exposed will not be enough.
The challenge is to improve security without allowing suspicion to replace evidence. Clear attribution, responsible information-sharing and practical safeguards can help reduce risks even when the underlying political rivalry remains unresolved.
FACT CHECK METER
FACT METER: 96% — HIGH CONFIDENCE IN THE DOCUMENTED DEVELOPMENTS
Status: The article's central events are supported by official US government announcements and published cybersecurity reporting. Broader conclusions about the strategic implications are analysis, not proof of a coordinated AI cyberwar.
Confirmed details:
On 8 October 2026, the US Department of Justice and FBI announced the seizure of infrastructure associated with Microscan and FishHub, tools US authorities alleged were used by China-linked actors against US and foreign networks.
Cybersecurity Dive reported on 1 October that a China-linked actor had targeted US AI policy experts through credential-phishing campaigns, citing Proofpoint. Proofpoint said it was not aware of successful compromises among the organisations covered by the report.
On 8 September, the NSA, FBI and CISA issued an advisory alleging industrial-scale model-distillation campaigns by China-based AI companies targeting US frontier models.
US and Chinese security experts have discussed safeguards for AI-related risks, including human control over consequential cyber operations and communication channels for serious incidents.
Important distinctions:
Allegations involving China-linked actors do not establish that every incident was directly ordered by Beijing.
The October cyber-tool seizure announcement did not establish that Microscan or FishHub were AI-powered.
Model distillation is a legitimate machine-learning technique. The US advisory concerns alleged unauthorised extraction of restricted capabilities.
Expert proposals for AI safeguards do not amount to a binding US–China cyber or military agreement.
AWX VERDICT: The available evidence points to growing tension over AI-related intellectual property, cyber espionage and network security. It does not establish a formally declared AI cyberwar. The immediate concern is that sensitive AI research and critical infrastructure are becoming increasingly valuable targets in a broader strategic rivalry, making stronger defences and reliable crisis communications more important.
WHAT TO WATCH NEXT
Further US enforcement actions: Whether investigators announce additional disruptions involving China-linked cyber infrastructure or release more evidence about affected organisations.
AI model security: Whether frontier AI developers introduce stronger protections against unauthorised extraction, credential theft and suspicious API activity.
Taiwan and critical infrastructure: Whether authorities report further attempts to access energy, transport, telecommunications or public-sector networks.
US–China AI dialogue: Whether both governments establish practical procedures for communicating about serious AI-related incidents and reducing the risk of miscalculation.
Export controls and computing supply chains: How restrictions on advanced chips, software and computing access affect each country's AI development strategy.
Independent attribution: Whether additional technical evidence clarifies the links between specific cyber operations, commercial enablers and state institutions.
THE AWX BOTTOM LINE
The US–China AI rivalry is becoming a contest over much more than model performance. It now involves protecting proprietary research, securing sensitive policy information, defending critical infrastructure and identifying hostile activity in cyberspace.
Recent US enforcement actions and cybersecurity reports show that these concerns are already real. But the evidence needs to be interpreted carefully. Allegations involving China-linked actors do not prove that every incident was directed by the Chinese government, and not every cyber operation connected to the rivalry relies on artificial intelligence.
The real danger lies in how these different threats could interact. A stolen credential, an exposed research system or a compromised infrastructure network could have far greater consequences when governments are already competing over advanced technology and military advantage.
Both countries have strong reasons to protect their systems and prevent cyber incidents from escalating into wider confrontations. Stronger defences, clearer evidence and dependable communication channels may prove just as important to long-term security as the next major AI breakthrough.
ATTLAS WIRE | AWX WORLD NEWS
Real Stories. Lasting Impact.
Comments
No comments yet.