The Honey Trap and the Hard Drive

Has the oldest trick in the spy’s playbook met the newest commodity in geopolitics? Facts assume greater importance when so much remains unproven. Jensen Huang, who built Nvidia into the supplier of the machinery on which artificial intelligence (AI) runs, admitted his affair with Alice Huang, no relation, formerly of Megaspeed, a Singapore-based data-centre company and a large Nvidia customer. US officials concluded that she was an asset of China’s Ministry of State Security aka its spymasters. Beijing called it a smear and Megaspeed denied smuggling chips to China. Nvidia’s board opened an independent inquiry while saying it saw no reason to think national security or company secrets were compromised. Nobody has shown that anything passed to anyone.

Huang’s resignation as CEO followed reports of another affair. But why would this one matter so much? Because the chip has become what the dreadnought was a century ago: the measure of a power’s seriousness.

“Whoever wins AI, wins,” Donald Trump likes to say, and both Washington and Beijing behave as though he is right. The US has rationed the most advanced processors since 2022. Rationing creates scarcity, scarcity creates brokers, and brokers, in time, attract spies. Chinese firms can lease computing power from data centres in Southeast Asia, which is precisely the gap where a company like Megaspeed operates.

Roger Faligot’s seminal and oft-updated Chinese Spies traced the craft of espionage from Mao’s security apparatus and Zhou Enlai’s patient network-building to Xi Jinping’s far better funded Ministry of State Security. What emerges is a service that has grown from eavesdropping at embassy dinners to one that prizes patience, cultivation and the long friendship; seduction and entrapment are just one of its instruments. In 2020, Clive Hamilton and Mareike Ohlberg, in their Hidden Hand, attended to a related subject: the Party’s United Front machinery, which courts businessmen, academics and politicians until the line between friendship, lobbying and collection is blurred. That blurriness is the point. Huang was courted by everyone. Was he a source of information, or was this a lever on a man with the president’s ear as some are wondering?

Now, the big doubt: the whole business seems ham-handed. A woman photographed beside the target at public events is hardly tradecraft. And Beijing has been nudging its companies towards Huawei silicon. Some experts claim China does not want to import a lot of Nvidia chips. What indeed would Beijing gain?

Perhaps less than the theory demands but more than the sceptics allow. Collection is cheap, and exposure is cheap too when a US president shrugs that everybody spies. A former China analyst, Dennis Wilder, told the New York Times that such an attitude reassures Beijing that the blowback will be manageable. Meanwhile, the scandal itself pays dividends. It has reopened the politics of export controls in Congress. Ironically, an operation that may have failed as espionage could succeed as a solvent of American trust.

Nor is Washington an innocent bystander. The CIA’s deputy director has said that private Chinese companies are now legitimate targets, and the agency has taken to recruiting in public, with Mandarin-language videos aimed at disaffected officials. Beijing might mock these efforts but each side has concluded that the economy is the battlefield and the firm is the new embassy.

The consequences, of course, are global. Singapore, Malaysia and Taiwan, the entrepôts of the chip trade, now face suspicion that their data-centre operators are the soft underbelly of a supply chain. The Gulf states promised American silicon, and middle powers from New Delhi to Brussels building sovereign computing capacity, must decide whom to buy from and whom to believe. Every country that wants AI must first decide whom to trust with the hardware.

Which brings us to Scott Bessent. In a recent oped in the Wall Street Journal, run in the same day’s paper as the Huang saga, the treasury secretary adopted Trump’s preferred term, “superintelligence” or SI, and a clean moral geography. American models, he argued, ship with safeguards; foreign ones, many of them open, carry weaker guardrails that a lone hacker can strip away. The latter have been turned on banks and companies in 48 countries. “American SI is part of the solution,” Bessent argued.

Part of this is sound engineering. Open weights can be modified; a developer who runs its own model can cut off abusers; defenders now race to patch flaws faster than machines can find them. The same technology serves the burglar and the locksmith. Thus, the locksmith must be quicker. But what about the sleight?

Bessent recalled that Anthropic announced a model able to exploit zero-day vulnerabilities in every major operating system and browser. Apparently, capability is not the monopoly of the villain. Safety, in this telling, is a property of nationality. The argument happens to double as the case for American primacy, for controls, for exporting the American stack. But it is an assertion, not an audit.

The cyber dimension sharpens the point. A model that can find a flaw in a browser can find one in a power grid—and Chinese operators stand accused of planting malicious code in US power and water systems. Beijing’s spy service, reportedly, now commands bigger budgets and modern tools, AI among them. Defence has become a race measured in hours, won by whoever holds the most compute.

And that returns us, inevitably, to the chip—and to whoever sits across the table from the man who sells it.

The Nvidia affair bites America precisely here. Safeguards are written into models. They are not so easily written into people. The most advanced systems are built, sold and guarded by humans who get lonely, vain and tired, and who are photographed at dinner. Espionage in the age of AI will be automated at the point of collection, a model sifting millions of messages where a clerk once read one. But recruitment remains stubbornly human.

Regardless of one individual’s guilt and gullibility or lack thereof, that fact won’t change.