1 hour ago
1
Last year, a statement from former White House AI advisor David Sacks stopped Washington cold. "We now have a Chinese open-weight model that is as good as the currently available models from OpenAI and Anthropic," Sacks told a podcast audience, describing Z.ai's GLM-5.2 as comparable to Anthropic's Opus and level with OpenAI's latest offerings. A Chinese startup had, in his telling, matched the two American frontier labs that have spent tens of billions of dollars to stay ahead.
The reaction in policy circles was predictable, viewed by many as a "DeepSeek" type watershed moment (or a “Sputnik” moment for AI). Some warned that American export controls—tightened out of fear that China might steal our most advanced models—were now slowing our own companies down while Beijing caught up on its own.
That debate matters. But it also misses a much larger, more dangerous point. The critical question was never merely whether China could build a competitive frontier model. It was how China would build it: by leveraging an unprecedented industrial espionage infrastructure that has, over the past three decades, executed the most expansive campaign of intellectual property theft in human history.
The Strategy Behind the Steal
We spent two years researching this pattern for our book. The conclusion was uncomfortable and unavoidable: the theft of American intellectual property by the People's Republic of China (PRC) is not a series of isolated incidents. It is a well-resourced national strategy directed from the highest levels of the Chinese Communist Party (CCP).
Consider the closest analogy to the current moment. A federal jury in San Francisco convicted former Google engineer Linwei Ding on multiple counts of economic espionage and theft of trade secrets. While drawing a Google paycheck, Ding uploaded more than a thousand confidential documents describing the company's AI supercomputing architecture to a personal account. Simultaneously, Ding was building AI companies in China, pitching Beijing investors on his ability to replicate the proprietary architecture he had taken. It was the first conviction on AI-specific economic espionage charges in American history. It will not be the last.
Ding represents the headline-grabbing version of the threat: a single insider walking out the door with the crown jewels. But focusing exclusively on these dramatic cases obscures a stealthier, more systematic campaign that has done far greater structural damage.
For more than a decade, state-linked actors have vacuumed up the personal data of the American people at an industrial scale:
- The 2015 OPM Breach: Exposed the security clearance files of more than 20 million federal employees—the most sensitive personnel records the government keeps.
- The Anthem Breach: Compromised the health records of nearly 80 million people.
- The Equifax Breach: Handed over the financial histories of some 145 million Americans.
None of these breaches were random. Aggregate these datasets and you map the human terrain of any target organization. Who holds a clearance? Who is in debt? Who is vulnerable? This is the raw material of counterintelligence—the blueprint an adversary uses to identify, pressure, or monitor individuals inside a critical company or government agency. The Ding case and the mass data breaches are not separate stories; they are the same narrative operating at different scales, both optimized to accelerate the PRC's ascent as an AI superpower.
The Threat of 'Digital Exhaust'
Now comes the newest chapter. Alongside human espionage and big-data harvesting, Chinese labs have increasingly utilized "distillation"—the practice of systematically querying leading American models via proxy accounts to extract their behaviors, subsequently training cheaper domestic competitors on the output. It is intellectual property theft automated via software.
The result is the arrival of models like GLM-5.2, which are functional and cheap enough that Western enterprises are already debating whether to integrate them. When European companies begin exploring the use of these models in enterprise settings, it should deeply worry anyone who understands where this technology originates and what running it inside a secure network invites.
This is the vulnerability the current AI-race debate routinely skips: You do not need to steal a frontier model to win the geopolitical competition. You need the data that surrounds it.
The richest source of that data is rarely a heavily guarded research lab. Instead, it is the everyday communication of American companies, defense contractors, and technology startups working in sensitive dual-use fields like quantum computing or autonomous systems. It is the steady stream of messages, proprietary files, meeting notes, and project plans moving every hour across consumer chat apps and fragmented collaboration tools that were never engineered to withstand a nation-state adversary.
We call this "digital exhaust." It is the operational residue of how an organization actually functions, and it is enormously revealing:
- A messaging thread reveals internal hierarchies and decision-makers.
- A shared drive exposes which critical program is behind schedule and which supplier holds the bottleneck component.
- A calendar maps exactly when and where executive leadership is traveling.
None of this information is classified, yet all of it is highly actionable. An adversary does not need to break advanced encryption if they can seamlessly map an organization from the outside, identify its weak points, and exploit them. This is precisely the operational targeting that mass data theft enables, and precisely the exposure that a fragmented, consumer-grade communications stack guarantees.
Securing the New Front Line
The frontier of great-power competition has fundamentally shifted, dissolving the old division of labor between public defense and private enterprise. The front line no longer runs exclusively through government agencies; it runs through global logistics firms, the energy grid, defense-tech startups, and commercial AI labs.
Private companies and critical infrastructure operators are now the first points of contact with nation-state adversaries. Yet, they are expected to coordinate with law enforcement and government partners in real time using an improvised patchwork of commercial applications—each representing a separate vendor, a distinct cloud, and an isolated point of failure.
The federal government solved this vulnerability for its own operations long ago by building sovereign, compartmented, end-to-end secure networks like the Joint Worldwide Intelligence Communications System (JWICS)—environments designed from the ground up on the absolute assumption that a nation-state is actively trying to get in. The private sector, now standing on that same front line, possesses no equivalent infrastructure.
Closing this gap is a matter of immediate national security. The current moment demands a unified coordination layer built to the rigid security standards the government holds itself to, but optimized for the commercial operators and law enforcement agencies that protect our critical infrastructure.
Achieving this requires a fundamental shift in how we approach enterprise security:
- Consolidated Environments: Moving communications and collaboration onto a single, hardened platform rather than a fragmented scattering of consumer tools.
- Sovereign Data Control: Ensuring an organization’s operational data and "digital exhaust" never reside in vulnerable, third-party commercial clouds beyond their direct control
- Verified Identity Architecture: Implementing strict identity verification to prevent adversaries from covertly infiltrating internal organizational communications.
- Cross-Institutional Security: Enabling secure, real-time collaboration across institutional seams—from a private tech firm to a police department to a military command—without downgrading to unencrypted group chats.
This shift toward sovereign, secure enterprise infrastructure—the exact architectural paradigm we are focused on building at Coalition Systems—is the only way to deny an adversary the digital exhaust they have learned to harvest so effectively. It brings the core principles of sovereign government networks to the commercial frontline.
The defining lesson of the last decade is that the PRC treats the systematic theft of American ingenuity as a core instrument of national power. The rapid closing of the AI capability gap is a stark reminder of how far that strategy has carried them. The correct response cannot just be guarding the frontier models inside the labs. We must secure the operational ground where the day-to-day competition is actually being fought: the everyday communications of the American enterprise. We have left that ground undefended for too long. We cannot afford to do so any longer.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
