Loading story…
X’s Global Government Affairs team said it identified and disrupted a suspected China-linked inauthentic network comprising roughly 200,000 accounts. About 200 accounts allegedly sought to manipulate U.S. discussion of AI data centers, electricity pricing, grid capacity, and energy policy; X suspended accounts found to violate its Authenticity policy.
The accounts used American-sounding identities, links to legitimate news reports, inflammatory commentary, and AI-generated anti-data-center cartoons to amplify claims that AI facilities raise household power bills, overload electrical grids, and benefit operators at the public’s expense. X has not identified a sponsor or provided definitive public attribution beyond suspected Chinese operators, while concerns about data-center development also reflect legitimate local economic and environmental opposition.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
X reported identifying an approximately 200,000-account inauthentic network it suspects was created by Chinese operators. It said roughly 200 accounts sought to manipulate U.S. debate over AI data centers and energy policy, and that accounts violating its Authenticity policy were suspended.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcefoxbusiness.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said two likely China-linked influence operations used ChatGPT to generate images and social media posts aimed at divisive U.S. debates over AI infrastructure and trade policy. The clusters, dubbed **"Data Center Bandwagon"** and **"Tech and Tariffs,"** produced English- and Chinese-language content that portrayed data center expansion as driving up electricity prices, straining power grids, consuming water, and harming the environment, while separate posts framed U.S. tariffs as a covert tool for controlling the global technology landscape. OpenAI said the operators likely originated in China, used VPNs, prompted ChatGPT in simplified Chinese, and posed as Americans on platforms including **X** and **YouTube**. OpenAI assessed that neither campaign achieved meaningful engagement and found no evidence the operators created the underlying controversies or materially shaped them, but the activity showed how AI tools can be used to amplify existing domestic disputes. The company also found the actors used ChatGPT for operational support, including editing work reports containing OPSEC details and discussing ways to exploit Facebook’s ecosystem and evade Meta’s coordinated inauthentic behavior detection. A separate analysis said the activity appeared tied to a private Chinese technology contractor serving provincial government clients, reflecting a deniable, scalable model aligned with broader Chinese propaganda patterns and strategic competition over U.S. AI and data center buildout.
Jul 31, 2026
The White House has accused China-linked actors and other foreign entities of running **industrial-scale AI model extraction and distillation campaigns** against U.S. frontier AI companies, saying the operations use tens of thousands of proxy or fraudulent accounts, jailbreaking techniques, distributed probing, and iterative prompt engineering to copy proprietary model behavior at scale. A memorandum from Office of Science and Technology Policy Director Michael Kratsios said the activity targets American AI innovation without requiring a traditional network breach, and warned that derivative systems may reproduce benchmark performance while stripping away safety controls, neutrality safeguards, and other protections built into the original models. Federal agencies have been directed to expand information sharing with AI firms and develop best practices for detecting, mitigating, and remediating the campaigns, with officials pointing to stronger telemetry, logging, identity controls, and real-time detection of distributed abuse as likely defenses. The administration is also weighing accountability measures, including possible sanctions and legal or export-control actions, while lawmakers advance legislation to identify and punish foreign actors targeting U.S.-owned AI models; China has rejected the allegations as "slander" and unjustified suppression, even as prior claims from OpenAI and Anthropic tied Chinese firms including **DeepSeek**, **Moonshot**, and **MiniMax** to large-scale distillation efforts.
Jun 29, 2026
Anthropic accused Alibaba and its **Qwen** research division of illicitly accessing its Claude models in what it called the largest known AI distillation attack against the company. In a letter to the U.S. Senate Banking Committee, Anthropic said operators used nearly **25,000 fraudulent accounts** to generate more than **28.8 million** Claude exchanges between April 22 and June 5, targeting high-value capabilities from the **Mythos Preview** model, including software engineering and agentic reasoning. The company said the activity was designed to replicate frontier-model performance without incurring the full cost of training a competing system. Anthropic warned that adversarial distillation can transfer advanced capabilities while omitting the original model’s safety guardrails, raising both security and national security concerns beyond intellectual property theft. The company linked the alleged operation to a broader pattern involving other Chinese AI labs, including **DeepSeek**, **Moonshot AI**, and **MiniMax**, and called for antitrust-safe threat intelligence sharing, continued AI chip export controls, and penalties for firms found to have improperly used U.S. model outputs. The disclosure has also spurred proposed U.S. legislative action, including potential sanctions or blacklisting of Chinese companies accused of training rival systems on unauthorized American AI outputs.
Jul 12, 2026