The Oldest Exploit

On November 8, Nvidia's board announced an independent investigation "in light of recent reporting that founder and CEO Jensen Huang has been the target of a foreign intelligence effort." The same day, Huang emailed his employees: "I was unfaithful to my wife." And: "There is no excuse for what I did." On the national-security reporting he wrote: "I support the investigation and will cooperate fully."

The email names no one. The New York Times reports that Huang acknowledged to the board he had been intimate with "a business executive who US intelligence determined to be a Chinese spy." The Times names her: Alice Huang, also known as Huang Le, a Chinese citizen and former executive of Megaspeed, a Singapore company that became Southeast Asia's largest buyer of Nvidia chips.

Nobody has been charged. China's Foreign Ministry called the first report "nothing but smears against China." Singapore denies having investigated her. She did not respond to reporters' requests for comment. The board says it has "no reason to believe that either national security or NVIDIA secrets were compromised." Every intelligence claim in this story comes from unnamed sources describing classified material.

The affair is his to answer for. The story is the system around it: what is on the record, and what that record already shows even if every intelligence claim turns out to be wrong.

Eleven days

What the operation was reportedly for

Bloomberg's account of the Times' November 6 report says the Ministry of State Security "was maneuvering to glean more detail about American artificial intelligence chips" and "possibly persuade Nvidia to try to make its most sophisticated semiconductors available to the Chinese."

Neither aim requires smuggling a single chip. Location verification can tell you where a GPU is. It can't tell you who has the ear of the man arguing about the rules.

Nvidia's reply: its cloud partners "do not ask us to seek changes in US law or advocate for sales to China," and "anyone seeking classified information through our NCP customers would have hit a dead end. We neither have nor share classified information with customers."

My read: the classified line answers a theft question, and the memo, as reported, also describes an influence aim. What a foreign service wants from a chip CEO isn't classified at all: the roadmap, who gets allocation, which customers are next in line, how he reads the White House and what he plans to say there. Nothing in the public record shows any of that changed hands.

The customer

Megaspeed was not a random customer.

• Origin. It began as 7Road International, the Singapore unit of the Chinese gaming company 7Road, and was repurposed for AI computing in 2023. Bloomberg calls it a "once-obscure spinoff of a Chinese gaming enterprise" that in under three years became the largest Southeast Asian buyer of Nvidia chips.
• Scale. Its Malaysian affiliate bought at least $4.8 billion of Nvidia-based equipment between June 2024 and February 2026, according to trade records cited by the Times.
• Supply. Most of its chips came through Aivres, the California unit of the sanctioned Chinese server maker Inspur, the Times reported in 2025.
• Scrutiny. In October 2025 the Times reported a Commerce Department investigation into whether Megaspeed helped Chinese companies evade export controls, and Singapore police investigated suspected breaches of Singapore law. On October 31, 2026, Singapore's Ministry of Home Affairs said: "Investigations into Megaspeed are ongoing." No charge against the company has been made public.
• Her role. Megaspeed listed Alice Huang as its managing director for its first eight months.

Nvidia says the smuggling allegations "were thoroughly investigated and debunked last year." Huang told Bloomberg: "We've studied all their deployments of our GPUs and counted every one." Megaspeed says it has hired outside counsel and is cooperating with the US government. My reading: "debunked" is a big word for a company Singapore says is still under investigation.

The Times also reports that in June 2024, "just weeks before Megaspeed began its purchases," photos posted to LinkedIn showed Jensen Huang and Alice Huang at a Taipei bar after a technology trade show.

Grant Nvidia everything it claims: no diversion, no secrets, nothing classified. What remains is the chief executive of a company whose chips are among the most tightly controlled exports in the world, who by the Times' account acknowledged to his board that he had been intimate with a former executive of Nvidia's largest Southeast Asian buyer. That is a governance problem even if it is never an espionage problem.

The fence

The US rules for Nvidia's AI chips in China:

Enforcement aims at the same object. Federal smuggling cases cover at least $160 million of H100 and H200 chips (two guilty pleas), at least $2.5 billion of AI servers (a Super Micro co-founder charged) and more than $300 million in another case. The Chip Security Act would require location verification for exported AI chips; it cleared a House committee 42–0 in March 2026 and is not law.

Beijing fights over the same object. In July 2025 China's internet regulator summoned Nvidia over alleged "backdoor safety risks" in the H20. Nvidia's position, on its blog: "NVIDIA GPUs do not and should not have kill switches and backdoors." Its August 2026 quarterly filing ties the two fights together: "following U.S. legislative proposals calling for mandatory features in our chips, China's government publicly questioned whether our H20 products have built-in vulnerabilities." The same filing says the H200 licenses came through, "but such sales were restricted by the PRC government."

Washington tracks where the chips go. Beijing asks what's inside them.

And through all of it, one person lobbied most visibly to open the gate. In May 2025 Huang said "the export control was a failure." In October 2025: "We went from 95% market share to 0%." In November: "China is nanoseconds behind America in AI." In December the GAIN AI Act, which would have given American buyers first claim on advanced AI chips, was kept out of the defense bill; Bloomberg called it a lobbying win for Nvidia. In May 2026 Huang flew to Trump's Beijing summit; Trump "asked me to come," he said. The memo about Alice Huang reportedly circulated shortly before that trip. In September he sat at the head table of the White House state dinner for Xi Jinping.

None of that is evidence that anyone shaped his views. The positions have an obvious commercial explanation, and he argued them under his own name. That is exactly what makes this channel hard to police: if an influence effort targets someone who already wants the same outcome, the outcome looks identical either way.

The oldest exploit

What officials describe is not new tradecraft. RAND's 2024 report on securing AI model weights says human-intelligence attacks often begin by "identifying individuals with access who are vulnerable or influential in some way." Then: "One common entry point is through professional relationships ... Other times it includes engaging through positive interactions with a member of the relevant gender (depending on the target)."

The record is long:

• Christine Fang. In 2020 Axios reported, citing US officials, that Fang, a suspected Chinese operative, had "sexual or romantic relationships with at least two mayors of Midwestern cities" and left the US in 2015 amid an FBI investigation. She was never charged.
• Xu Yanjun. An officer of China's Ministry of State Security, convicted by a US jury in 2021 for targeting GE Aviation. His cover was academic: invitations "under the guise of Chinese universities."
• AI itself. A former Google engineer was convicted in January 2026 of stealing trade secrets about Google's AI supercomputing hardware and software (a judge later set aside the economic-espionage counts; the theft convictions stand).

The field has written all of this down, and its own standards admit the gap. RAND says the top level of protection, against the most capable nation-states, "is currently not possible." As of May 2025, Anthropic's ASL-3 security standard committed to "robust controls to mitigate basic insider risk" but called "sophisticated or state-compromised insiders" out of scope. At a House Intelligence Committee hearing in July 2026, H.R. McMaster said: "The counterintelligence threat has lagged way behind."

Two details in the Times' first story show how far behind. The first: "Jensen Huang has not received a defensive briefing, warnings sometimes given to Americans who are being targeted by foreign intelligence services, people briefed on the surveillance said." The second: "Roughly a year ago, Trump was briefed about the intelligence findings ... and chose not to do anything with the information."

On October 29 Nvidia said it was "confident that if the US government believes that any person is a threat to American industry, it would let us know." If the reports are accurate, Nvidia was in effect waiting for a call that Washington, holding the information, had not made.

Asked whether Huang would brief lawmakers, Nvidia declined to comment, and added: "Our chief executive has an outstanding security team that accompanies him where needed." That is physical protection, not counterintelligence.

What changes for AI

Policy. My prediction: for as long as the investigation is open, every argument for selling AI chips to China arrives with an asterisk. Two chip-export bills, the AI OVERWATCH Act and the Chip Security Act, sit in the Senate's version of the defense bill. By early counts Democrats take both chambers in January, and Senator Chris Coons, in line to chair the Foreign Relations Committee, has already written that "Congress will investigate and get answers." Huang's reply to the House chairs is due November 11. Nvidia reports earnings on November 17. The briefing the chairs asked for is the next day.

Key-person risk. Nvidia is worth about $4.5 trillion, and the Times describes a "unique structure at Nvidia where he dictates all aspects of its business while overseeing some 60 people who directly report to him." The risk factors in its annual report never name him; they say Nvidia is "highly dependent on the services of our longstanding executive team." Key-person risk usually means the bus problem. This is the other kind: the key person stays, and the question becomes who has had access to him and what they wanted.

Everyone else building AI. Labs guard model weights, chipmakers guard designs, governments guard the chips in transit. The people with the most access, and the most to offer an adversary, are the executives who meet customers, investors and officials across borders every week. If your insider-risk program stops below the C-suite, it has a hole exactly where this story happened.

My read

On October 29 Nvidia's chief executive called his dealings with a former Megaspeed executive "completely normal and not unusual," and his company called his interactions with her "not unusual or unexpected." Ten days later he admitted an affair that, the Times reports, he acknowledged to the board was with her. The Times now calls Nvidia's earlier statements about the relationship "misleading."

The board says it has "no reason to believe" secrets or national security were compromised, and in the same statement that it "has confidence in Jensen and his leadership team." Nvidia's spokesman says Huang is committed to leading "without interruption." Continuity may be the right outcome. It should be the board's finding after the investigation, not a line before it. Nobody outside can judge that finding without four things Nvidia hasn't given: the directors' names, the law firm, a defined scope, and whether the results will be published. The scope should include the company's own earlier statements.

Washington doesn't come out better. It spent four years making sure an H100 can't reach China without a license, and it is still debating whether every exported GPU should report its own location. By the Times' account, the president was briefed on the findings about a year ago; as of late October, Huang had not received a defensive briefing.

For engineers

Put influence in your threat model, not only access. The person who sets your company's position on export rules belongs in it, whether or not they can read a single weight file.

Stop treating "classified" as the line. Your roadmap, your customer list and your policy positions aren't classified. They are still the assets.

Don't make "the government would tell us" your detection plan. In this story, according to the Times, it didn't.