AI Companies Face Cybersecurity Risks Amid Espionage Concerns

Tal Feldman and Ibrahim Dagher argue that weak cybersecurity at leading US artificial intelligence companies threatens the country's advantage over China. Feldman and Dagher argue that Washington can require stronger security without passing another statute. The authors contend that public debate has rightly examined AI agents attacking other companies but has neglected whether AI companies can prevent intrusions.

OpenAI recently learned that a Saudi employee allegedly placed an audio recording device in an executive meeting room. Senior employees regularly discuss confidential material, including proprietary research, in that room at OpenAI's San Francisco headquarters. In July, three researchers investigating security flaws penetrated OpenAI's systems and reached an internal code repository containing algorithmic secrets. OpenAI paid the researchers a $6,500 bounty for reporting the vulnerabilities. The researchers completed the intrusion in less than 72 hours without particularly advanced hacking tools. One researcher told The Wall Street Journal, "We're just three guys with Claude and Codex subscriptions," referring to publicly available coding agents from Anthropic and OpenAI. A hacker also penetrated OpenAI's internal messaging system in 2023 and acquired information about OpenAI's research. OpenAI notified neither the FBI nor the public about that intrusion.

Feldman and Dagher argue that countries such as China possess the advanced tools, time and incentive needed to infiltrate US AI companies. The authors argue that stealing leading US models would allow competitors to catch up without paying development costs. The authors warn that restrictions on advanced chip sales and billions invested in AI infrastructure would accomplish nothing unless laboratories take cybersecurity seriously. The authors argue that the three incidents likely indicate a broader security problem.

AI companies have openly acknowledged inadequate defenses against sophisticated espionage. Anthropic chief executive Dario Amodei said in 2023 that a government making model-weight theft a top priority would succeed against Anthropic. Model weights are trillions of numerical values generated through months of costly training that constitute an AI model. However, Anthropic's risk report this August still said Anthropic could not withstand nation-state attackers and did "not believe any frontier AI developer currently meets this bar." Former Anthropic and OpenAI researcher Jacob Coxon argued that no US advantage could endure because Beijing could steal US progress whenever Beijing chose. Miles Brundage, who worked on OpenAI's preparedness for advanced AI, said AI companies do not even claim the ability to prevent state actors from stealing or tampering with model weights.

Rand researchers identified 38 methods for stealing model weights, including planting portable devices, altering hardware before installation and bribing or coercing employees. Cloud-company data centers provide another entry point because AI laboratories often use those facilities to train and operate models. The industry's algorithmic secrets also lack adequate protection. Amodei told the Council on Foreign Relations last year that some AI-industry secrets worth "$100 million" amount to only a few lines of code. Amodei said people were certainly trying to steal those secrets and might already be succeeding.

AI companies are competing intensely to develop superintelligence. Money and employee time devoted to cybersecurity cannot also be devoted to training the next model. Anthropic has argued that resisting well-funded state attackers should be an industry cybersecurity priority. However, Anthropic said the company "cannot commit to following" that priority independently.

Congress last year instructed the Pentagon to establish security requirements for purchased AI and apply those requirements to the relevant contractors and cloud providers. The Pentagon has still not started the public rule-amendment process 10 months later. The Commerce Department can make model exports subject to licensing and limit licenses to laboratories that satisfy security requirements. The Trump administration used that authority to force Anthropic to withdraw Mythos and Fable from the market in June. The federal government can also attach security conditions to loans and land leases supporting data-center construction. Under that approach, only AI companies satisfying strict security requirements could obtain federal financing or use public land. Feldman and Dagher conclude that a foreign government with substantial funding and unlimited time can certainly infiltrate OpenAI if three researchers using Claude subscriptions could do so in three days.