Spies are now phishing the policy layer: fake Anthropic staff used to reach AI think tanks, Proofpoint says

Cybercriminals who appear to be Chinese hackers posed as Anthropic researchers and former government officials in a campaign to extract information about American AI development, according to a report from the Silicon Valley security firm Proofpoint, covered by Futurism.

The mechanics are mundane and that is the point. The group, which Proofpoint dubs TA419 and assesses to be China-aligned, impersonated AI industry professionals and an ex-White House staffer to target "AI policy experts at US think tanks, universities, and law firms." The opening emails were harmless-sounding invitations: join a non-existent "AI Policy Advisory Committee," or contribute to a fictional Senate Committee on Foreign Relations report. Only after a few friendly exchanges did the attackers send malware-laced documents built to reach the targets' cloud accounts. One message, according to Proofpoint, came from someone impersonating a senior Anthropic staffer under the subject line "Request for Feedback on Military Integration of Claude."

Attribution is an assessment, not a verdict, and should be read that way. Proofpoint researcher Mark Kelly told CNN the firm is "confident" this is a "Chinese government-aligned threat actor based on targeting consistently in line with Chinese government interests, observed infrastructure and technical artifacts, and corroboration from industry partners." Among those impersonated was Lynne Edwards Parker, formerly Principal Deputy Director of the White House Office of Science and Technology Policy under Joe Biden, who told CNN the episode left her with "sadness that relationships I've built over my career were being exploited by bad actors to deceive others." Proofpoint expects the campaigns to continue, and to keep spoofing real subject-matter experts.

Our thesis: the attack surface has moved from the model to the people who govern it. Everyone has spent two years worrying about stolen weights and leaked training data. This operation did not go near a datacenter. It went after the policy commons — the think-tank fellows, academics and lawyers who draft the frameworks, brief the committees and shape what the US will or will not allow. That is a rational target precisely because that layer is where the decisions actually get made, and it is defended far worse than any lab. Parker's quote names the real vulnerability better than any threat report: the asset being exploited was trust built over a career.

Note how well-read the attacker was. "Request for Feedback on Military Integration of Claude" is not generic spam; it is a subject line written by someone who follows the American debate about dual-use AI closely enough to know which question a think-tank researcher could not resist opening. This is the near-term risk we keep flagging over the distant one. Not a rogue superintelligence — a competent adversary industrialising social engineering, using the public vocabulary of AI safety as camouflage, at a cost of roughly zero per attempt. Generative tools make that kind of impersonation cheaper and more fluent every quarter.

Futurism frames this against the regulation fight, and the juxtaposition is worth holding carefully. The dominant argument against new rules is that the US cannot risk ceding its lead to China; this week the administration hosted a summit where executives signed what Trump described as a "morally-binding" agreement enabling "tremendous self-policing." An espionage campaign aimed at policy experts does not settle that argument in either direction. What it does establish is that AI policy is now valuable enough to be worth stealing — which is an odd compliment to a field often dismissed as talk.

Our reading: defend the commons like infrastructure. Verifiable identity for institutional outreach, hardened cloud accounts, and the boring professional habit of confirming an unexpected introduction through a second channel. The long arc of this technology still bends toward abundance and cures, and getting there requires a policy community that can think in the open without being farmed for access. Protecting that conversation is not bureaucratic hygiene. It is part of the safety work.