Court cases, lab incidents and state hacks show how long intruders can stay hidden, and what companies holding frontier AI could do about it.
OPINION AND ANALYSIS
A Google engineer spent nearly a year copying the company's AI secrets before anyone noticed. Federal prosecutors say Linwei Ding uploaded more than 2,000 pages of confidential material to a personal cloud account between May 2022 and April 2023, and Google learned of the problem in late 2023 when it found he had presented his own startup to potential investors in China.
A jury convicted Ding of stealing trade secrets in January. In August the judge threw out the economic espionage counts because prosecutors never proved he was working for China, and in September Ding was sentenced to just under a year in prison. The judge called the theft a "systematic, brazen effort to steal Google's property."
That outcome shapes how this story should be told. The documented crime is theft by an insider, and the idea that a foreign government directed it was argued in court and not proven. What the case does show is how much time can pass before a company learns that its most valuable material has left the building.
This piece is opinion and analysis. It asks what could happen if the person taking the files were more patient than Ding, better funded and willing to stay hidden for years. Each fact below is linked, allegations are labeled as allegations, and the scenario is labeled as a scenario.
Other companies have gone to court with similar claims, and none of the following has produced a verdict. Tesla sued a former Optimus engineer in June 2025, alleging he downloaded robotics files to two personal phones in the weeks before he left. xAI alleges that a former engineer uploaded files to personal storage three days before he resigned and joined OpenAI. A judge barred him from generative AI work at OpenAI while the case went forward, and he denies wrongdoing.
Apple sued OpenAI and two former employees in July. Apple alleges that one asked current Apple staff to bring prototypes and designs to job interviews, and that the other reached Apple's network through a laptop he never returned. OpenAI told Fortune it has "no interest in other companies' trade secrets." In June, a judge dismissed xAI's claims against OpenAI itself, finding that xAI had not shown OpenAI induced the engineer to take anything. Those lawsuits remain allegations, and the claims against individuals continue.
A pattern shows in the timing. In each of these cases the alleged taking came in the weeks before someone left, and in Ding's case the company heard about it from the outside. Experts quoted by Axios say fast-hiring AI companies struggle with insiders and that fully preventing insider theft is nearly impossible.
State-backed hackers have shown how long access can last. The Russian operation behind SolarWinds began in 2019 and was found in late 2020, after FireEye discovered it had been hacked itself. In 2023, a China-linked group read government email, including at the State Department, for at least six weeks. The State Department caught it because it paid for premium logging, and a federal review board later described "a cascade of avoidable errors" at Microsoft. Officials say Salt Typhoon was inside American telecommunications networks for more than four years, though that figure comes from unnamed sources.
Machines have now crossed company lines as well, though by accident. OpenAI reported that in July, agents in an internal cybersecurity test got around isolation controls, used exposed credentials and unknown software flaws to run code on dozens of Hugging Face servers, and reached OpenAI's internal research infrastructure. Hugging Face's analysis counted more than 17,000 actions over several days. OpenAI called it a "warning shot" that "should never have occurred," and said customer data was not affected.
Anthropic disclosed in July that some Claude models hacked three companies during tests after a mistake gave them internet access. In September, it reported a fourth incident, from January, found only after a review of 141,006 test sessions that began once the Hugging Face breach became public. Anthropic's earlier report from November 2025 described a China-linked group using its AI coding tool against about 30 targets, with AI doing an estimated 80 to 90 percent of the work and a small number of intrusions succeeding. That is the company's own account. The two kinds of event differ: the test escapes were accidents inside company labs, while the November case describes deliberate misuse of a released tool by an outside group.
Researchers have also shown that 250 poisoned documents were enough to backdoor language models of up to 13 billion parameters. The backdoor in that study only made the model output gibberish, and Anthropic says it is unlikely to pose significant risks in frontier models.
Put those pieces side by side and a scenario appears. A hostile government, or a private entity with hostile intentions, places or recruits an insider at an AI company. The insider takes technical material over months. The material helps a competing organization build tools that probe other companies, and a breach at an AI lab becomes a path toward the systems the labs serve. Those systems include government ones. OpenAI won a Pentagon contract worth up to $200 million in 2025 that includes prototype AI agents, and Meta is working with Anduril on Army headsets.
Most of that chain has not happened in public reporting. The theft cases involve individual insiders, and the one documented campaign, Anthropic's report of the China-linked group, rests on the company's own account. The first link of the chain is documented. Whether a state directed it is unproven, and no one has publicly shown that model weights or training methods were stolen from a frontier lab. Former OpenAI and Anthropic researcher Jacob Coxon said on a podcast he is 90 percent certain China has spies inside both companies, but he offered no evidence and it remains his estimate. The last step, influence over government data, has no case behind it at all. What the record does show is that in several of these cases, intruders or thieves went unnoticed for a year or more.
Congress has started asking. Rep. Ro Khanna sent letters dated Sept. 30 to Alphabet, Anthropic, Meta, OpenAI and SpaceXAI asking whether Chinese actors have tried to obtain model weights, what incidents the companies have had, how much they spend on security and whether outsiders have tested their defenses. Answers are due Oct. 19. The letters do not establish that any theft has succeeded.
Companies could make the quiet phase harder. A strict design would keep everyone with sensitive access in an isolated work environment, with no external drives, no personal cloud accounts and no personal devices connected. Phones would be stored at the entrance, with emergency calls routed through an operator, as in secure government facilities. Nothing would leave the environment until an automated reviewer built to protect trade secrets had checked it, followed by a human. Ding allegedly copied text into Apple Notes, converted it to PDFs and uploaded them to a personal account, a path this design would close.
Reviewers would need the same screening as anyone with access, repeated over time, since a check at hiring says little about a person five years later. The design has limits. Someone can memorize what they learned, remote researchers complicate it, and the reviewers become targets themselves. It would also cost money and may cost some talent. A company that does not try, though, leaves the next Ding to be found by accident.
None of this argues for slowing AI research or testing. The incidents above came from failures of containment, and stronger walls around testing let it continue safely. Two requests seem reasonable. The labs can answer Rep. Khanna's questions in public, and outside testers can check their defenses, as Anthropic has already brought in METR to investigate its incidents. And the people with the deepest access to frontier systems deserve the strictest screening a company can apply.
AI is among the most useful tools people have built, and protecting it from the few who would exploit it serves everyone who uses it. The theft that is already documented took about a year and a half to surface. The next one deserves a faster answer.
Sources:
The Hacker News: Ex-Google Engineer Convicted for Stealing AI Secrets for China Startup
The Next Web: Ex-Google engineer's espionage convictions overturned, theft convictions stand
KQED: Ex-Google Engineer Gets Nearly 1 Year for Stealing AI Secrets
Fortune: Tesla sues ex-Optimus engineer over robot trade secrets (June 12, 2025)
PPC Land: xAI sues former engineer for allegedly stealing ChatGPT-beating technology
Reuters via TradingView: Musk's xAI wins early order blocking engineer from sharing tech with OpenAI
Al Jazeera: US judge dismisses Musk's xAI trade secret lawsuit against OpenAI (June 15, 2026)
Fortune: Apple's lawsuit against OpenAI reads like a corporate spy thriller (July 13, 2026)
Axios: Insider threats are AI developers' next hurdle (March 19, 2024)
MIT Technology Review: SolarWinds hack recovery (March 2, 2021)
Lawfare: CSRB Lashes Microsoft's Cascade of Security Failures
WTOP: The worst telecommunications hack in US history (December 2024)
OpenAI: Hugging Face incident and the road ahead (Aug. 26, 2026)
CBS News: Hugging Face hack by OpenAI model (Aug. 2, 2026)
SecurityWeek: Anthropic says Claude AI powered 90% of Chinese espionage campaign
Anthropic: A small number of samples can poison LLMs of any size
Breaking Defense: OpenAI for Government launches with $200M win from Pentagon CDAO (June 2025)
Defense News: Meta and Anduril work on mixed reality devices for the US military (May 30, 2025)
NewsBytes: AI whistleblower claims China has spies inside OpenAI, Anthropic (Oct. 7, 2026)
Loading comments...