Spoofed Anthropic emails hunted US policy experts: the soft target in the AI race isn't the lab

Cybercriminals who appear to be Chinese hackers posed as Anthropic researchers and former government officials in a campaign to extract information about American AI development, according to a report from the Silicon Valley security firm Proofpoint. The group, which Proofpoint tracks as TA419 and describes as China-aligned, targeted "AI policy experts at US think tanks, universities, and law firms." The lures were deliberately dull: invitations to join a fabricated "AI Policy Advisory Committee," or to contribute to a fictional Senate Committee on Foreign Relations report. Only after several benign email exchanges did the senders deliver malware-laced documents designed to reach the targets' cloud accounts.

One detail does the work of a whole threat briefing. Per Proofpoint, an email impersonating a senior Anthropic staffer carried the subject line "Request for Feedback on Military Integration of Claude," aimed at someone working at a think tank. Proofpoint researcher Mark Kelly told CNN the firm is "confident" this is a "Chinese government-aligned threat actor based on targeting consistently in line with Chinese government interests, observed infrastructure and technical artifacts, and corroboration from industry partners." Lynne Edwards Parker, formerly Principal Deputy Director of the White House Office of Science and Technology Policy under Joe Biden, was among those impersonated; she told CNN the episode left her with "sadness that relationships I've built over my career were being exploited by bad actors to deceive others." These are Proofpoint's assessments and the subjects' accounts, not adjudicated findings.

Notice what was not attacked. Not model weights. Not a data center. Not a novel exploit. The target was the thin human layer that decides what the United States does with AI — the analysts, academics and lawyers who draft the memos that become export rules and procurement standards. Exfiltrating frontier weights is expensive and loud. Knowing six months early how a military-integration debate is trending inside Washington's policy circuit is cheap, quiet, and arguably worth more. The choice of lure topic is the tell: the attackers understood exactly which conversation their targets could not resist joining.

The operation ran on borrowed reputational capital. Real names, real institutional affiliations, plausible committee letterhead. Defenses built on the assumption that state-grade espionage looks technically sophisticated miss this entirely, because the sophistication is social. And this is where AI compounds the problem in the most boring possible way: the hardest part of this attack used to be writing fluent, context-aware intro emails in a specialist policy register. That cost is now close to zero. We have argued that the genuine near-term danger from agentic AI is the industrialization of fraud and espionage, not a distant superintelligence. This is what that looks like in the field — no autonomous agent required, just a collapse in the price of credible impersonation.

The timing sharpens the irony. The report lands in a week when the White House hosted AI executives who signed what Trump described as a "morally-binding" agreement allowing "tremendous self-policing," while figures including Anthropic's Dario Amodei continue to ask for actual rules. The standard argument against regulation is that the US cannot risk ceding its lead to China — "Whoever wins AI, WINS!" as Trump put it on Truth Social. But in this episode China's apparent edge has nothing to do with compute, chips or model quality. It is an email thread.

Our reading: the AI security perimeter now includes think tanks, university centers and law firms — institutions with no security operations team, no budget for one, and a professional obligation to answer emails from strangers. The practical implication is unglamorous and urgent: policy institutions need the identity hygiene that labs already have. Verified channels, out-of-band confirmation before opening attachments, and a default posture that treats unsolicited committee invitations as hostile until proven otherwise. Proofpoint expects TA419 to keep spoofing the identities of real subject-matter experts, which means this is a standing condition, not an incident.

The long arc has not changed. We still think this technology ends in shared gains — the medicines and the healthy years it unlocks will not respect borders, whoever builds them first. But the short road runs through a stretch where trust itself becomes the scarce resource, and rebuilding it requires verification infrastructure nobody finds exciting to fund. That is the bill arriving now, and it is far smaller than the one that comes from ignoring it.